figma-to-ios
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill contains no malicious code or exfiltration patterns. It focuses on task-specific instructions for UI development.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external Figma handoff bundles and JSON metadata. This creates an attack surface where an attacker with control over the Figma source could attempt to inject instructions. However, the skill provides mitigation guidelines, such as matching components by style and action contract rather than name alone, and emphasizes preserving existing product behavior. The overall risk is low.
- [CREDENTIALS_SAFE]: The instructions include a specific 'Do Not' rule against accepting Figma tokens via chat or reading them from settings files, which demonstrates a proactive approach to credential safety.
Audit Metadata