figma-to-code
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill inherently processes external, untrusted content from Figma which serves as a potential vector for indirect prompt injection.
- Ingestion points: Design data is pulled from Figma layers, names, and metadata via MCP tools like get_design_context and get_metadata.
- Boundary markers: Clear instructions in references/verification-and-boundaries.md direct the agent to treat design data as untrusted and not follow instructions found within it.
- Capability inventory: The agent has the capability to write files to the repository and execute local commands for testing and building.
- Sanitization: The skill explicitly mandates that design text should not be treated as instructions or commands.
- [COMMAND_EXECUTION]: The skill instructs the agent to perform various shell-based verification tasks.
- Evidence: The Operating Procedure and Verification Checklist require running project-specific linters, tests, and build scripts. Additionally, references/benchmarks.md references the use of gh (GitHub CLI) and npm tools for maintenance tasks.
- [EXTERNAL_DOWNLOADS]: The skill workflow involves downloading external assets from Figma services.
- Evidence: The skill retrieves and downloads image and SVG assets using URLs provided by the configured Figma MCP server, as described in the Asset Rules section of references/implementation-patterns.md.
Audit Metadata