code-to-figma
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill generates scripts that interact with the GitHub Gist API to host design token artifacts. This involves the use of a Personal Access Token (PAT) with 'gist' scope. The skill documentation explicitly instructs users to store this token in GitHub Secrets (
GIST_TOKEN) and provides warnings against leaking it in shell history. Communications are restricted toapi.github.com, a well-known and trusted service. - [EXTERNAL_DOWNLOADS]: The skill requires the
node-html-parserpackage, which is a standard utility for HTML parsing in Node.js environments. Instructions for adding this dependency via standard package managers (npm, pnpm, etc.) are clearly documented. - [COMMAND_EXECUTION]: The skill generates local Node.js scripts for walking the project's HTML and CSS files. These scripts use standard file system operations (
readFileSync,writeFileSync) and do not perform arbitrary or suspicious command execution. The workflow relies on the GitHub CLI (gh) for administrative tasks like secret management and Gist creation, leveraging the user's existing authentication context.
Audit Metadata