designing-in-figma
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the @google/design.md utility via npx for design token validation and export. This package is maintained by Google Labs.
- [COMMAND_EXECUTION]: Executes shell commands including 'npx @google/design.md lint' and 'npx @google/design.md export' to validate and process design system tokens from the project workspace.
- [PROMPT_INJECTION]: The skill ingests and processes 'DESIGN.md' files from the repository which contain design instructions and token values used to drive the generation of UI components in Figma.
- Ingestion points: Project-root 'DESIGN.md' file containing YAML metadata and Markdown rationale.
- Boundary markers: Relies on the structured specification of the DESIGN.md format (YAML frontmatter).
- Capability inventory: Access to 'use_figma' for JavaScript execution within the Figma environment, file creation tools, and shell command execution.
- Sanitization: Incorporates a mandatory linting step using '@google/design.md' to detect broken references and WCAG contrast violations before token data is materialized into Figma variables.
Audit Metadata