code-to-figma
Warn
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The skill generates project-specific JavaScript files (
walk-<site>.mjs,convert-to-dtcg.mjs,push-to-figma.mjs) by adapting templates provided in the reference documentation. These scripts are subsequently executed vianodeto process project source files and build artifacts. - [COMMAND_EXECUTION]: The instructions require the execution of various CLI tools, including
node,jq,gh(GitHub CLI), andgit. These are used to validate generated artifacts, manage GitHub Gists, and configure repository secrets. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of compiled HTML and CSS files. This creates a surface for indirect prompt injection if malicious content is introduced into the project's build artifacts, potentially influencing the agent's assessment or the data exported to Figma. The skill implements structure validation using
jqto mitigate risks during the export process. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
node-html-parserpackage from the npm registry to support HTML walking functionality. It also fetches and patches data to GitHub Gists, utilizing a well-known service for its core synchronization logic.
Audit Metadata