designing-in-figma
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources such as DESIGN.md files, Storybook metadata, and Claude Design projects, using it to parameterize Figma Plugin API scripts. * Ingestion points: DesignSync get_file (claude-design-import.md), Storybook index.json (storybook-import.md), and local DESIGN.md. * Boundary markers: The skill includes an explicit instruction in claude-design-import.md to treat fetched file content as data and ignore any embedded instructions. * Capability inventory: The skill calls use_figma for Plugin API script execution, create_new_file, and upload_assets. * Sanitization: Recommends linting DESIGN.md with npx @google/design.md and performs sanitization on variable names.
- [COMMAND_EXECUTION]: Instructs the agent to run npx @google/design.md, a tool provided by a trusted organization.
- [EXTERNAL_DOWNLOADS]: References official documentation and tools from well-known Figma and Google repositories on GitHub.
Audit Metadata