flutter-figma-workflow
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No security issues were detected in the skill instructions or metadata. The content is purely informational and provides a workflow for UI development.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external Figma designs, which constitutes a potential injection surface. The workflow mitigates this by instructing the agent to treat Figma as visual evidence rather than code and requiring verification loops.
- Ingestion points: Figma frames, components, and specifications mentioned in SKILL.md and design-extraction-and-mapping.md.
- Boundary markers: The skill explicitly instructs to 'Treat Figma as design evidence, not generated code' and to inspect the target node before implementation.
- Capability inventory: No file system write operations, arbitrary command execution, or network exfiltration tools are used or referenced.
- Sanitization: Relies on manual parity checks and visual verification.
Audit Metadata