figma-use-motion
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [SAFE]: Documentation and code patterns for the use_figma tool are provided to manage Figma animations.
- [COMMAND_EXECUTION]: The use of ffmpeg for frame extraction is documented as a standard designer workflow; no unsafe command construction is suggested.
- [INDIRECT_PROMPT_INJECTION]: The skill processes Figma node data (ingestion point: node selection and properties) and uses tools with JS execution and CLI capabilities (inventory: use_figma, ffmpeg). However, it mitigates risk by specifying strict allowlists for animatable fields (sanitization: Animatable Fields allowlist) and lacks complex interpolation.
- [DYNAMIC_EXECUTION]: JS code snippets for node manipulation follow official Figma Plugin API standards and focus on property updates.
Audit Metadata