figma-generate-design
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [SAFE]: No malicious patterns such as credential theft, data exfiltration, or obfuscation were identified. The skill's operations are consistent with its stated purpose of design system integration.
- [COMMAND_EXECUTION]: The skill utilizes the
use_figmatool to execute programmatically generated JavaScript for interacting with the Figma Plugin API. This is a standard capability for automating Figma tasks and is used here to create and modify UI elements as requested by the user. - [PROMPT_INJECTION]: The skill ingests untrusted data in the form of local source code (e.g., Code Connect files like
*.figma.tsx) to identify design tokens. While this represents a surface for indirect prompt injection, the impact is minimized by the skill's focus on structured data extraction (URLs, node IDs) rather than executing arbitrary instructions from the code content.
Audit Metadata