figma-to-code
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process design data from Figma MCP servers, which constitutes an external, potentially untrusted input surface.\n
- Ingestion points: Design context and metadata retrieval tools (e.g.,
get_design_context,get_metadata) described inSKILL.mdandreferences/implementation-patterns.md.\n - Boundary markers: The
references/verification-and-boundaries.mdfile contains a dedicated 'Prompt-Injection Boundary' section that explicitly instructs the agent to ignore any commands or instructions found within Figma layer names, text, or metadata.\n - Capability inventory: The skill has the ability to write to repository configuration files (e.g.,
AGENTS.md,.cursor/rules/) and invoke Figma MCP server tools.\n - Sanitization: Documentation provides clear guidelines for the agent to treat all design-side content as untrusted data rather than authoritative instructions.\n- [EXTERNAL_DOWNLOADS]: Maintenance procedures in
references/benchmarks.mdinvolve fetching metadata from the officialfigma/mcp-server-guiderepository using the GitHub API. This targets a well-known service and an official vendor repository for skill synchronization.\n- [COMMAND_EXECUTION]: The skill references the use of the GitHub CLI (gh) for updating benchmark snapshots. This is restricted to maintenance workflows and involves standard, well-known developer tooling.
Audit Metadata