understand-figma
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external Figma files which are passed to an LLM subagent for analysis. An attacker could potentially embed malicious instructions in Figma node names or metadata to influence the agent's behavior.\n
- Ingestion points: Figma document structure and metadata are fetched from
api.figma.comvia thefigma-scan.mjsscript.\n - Boundary markers: The data is batched into JSON objects before being sent to the
design-analyzersubagent, but there are no explicit delimiters or warnings to ignore instructions inside the design data.\n - Capability inventory: The skill can write to the local filesystem (
knowledge-graph.json,meta.json) and execute shell commands via the parent agent.\n - Sanitization: The skill does not perform sanitization of text content retrieved from the Figma API before it is processed by the LLM.\n- [COMMAND_EXECUTION]: The skill executes several shell commands to manage its environment and perform analysis.\n
- Evidence: Phase 0.3 executes
pnpm installandpnpm buildto prepare the core dependencies. Phases 1 and 3 execute local Node.js scripts (figma-scan.mjsandfigma-merge.mjs) to process design data.\n- [EXTERNAL_DOWNLOADS]: The skill downloads external dependencies from the NPM registry to build the@understand-anything/corepackage during the initialization phase.\n - Evidence: The pre-flight phase in
SKILL.mdinvokespnpm installif core distribution files are missing.
Audit Metadata