sb-figma
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill operates entirely on local project files and communicates with Figma through the platform-provided MCP (Model Context Protocol). No hardcoded credentials or sensitive data exfiltration patterns were detected.
- [SAFE]: All scripts (Node.js and Python) perform legitimate data transformation tasks, such as OKLCH color resolution, token parity checking, and inventory management. Scripts include safety measures like filename sanitization to prevent path traversal.
- [SAFE]: Instructions to the agent emphasize using native structured data from Figma rather than screenshots, which is a security and accuracy best practice that reduces the risk of visual interpretation errors.
- [SAFE]: The skill maintains a clear boundary from exploration (sb-explore) and focus on delivery of approved designs, reducing the risk of accidental or experimental changes to production code.
- [SAFE]: Network activity is restricted to local environment fetches (e.g., '/index.json' in the Storybook wrapper) and standard MCP interactions managed by the host environment.
Audit Metadata