figma-generate-design
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides structured guidance for a designer agent to interact with the Figma platform using authorized tools and design system tokens. All operations described align with the intended use case of UI design automation.- [COMMAND_EXECUTION]: The skill involves generating and executing JavaScript code within the Figma Plugin environment via the
use_figmatool. This is a primary functional requirement for creating, positioning, and styling design nodes and is considered safe within the context of the tool's purpose.- [PROMPT_INJECTION]: The skill features an attack surface for indirect prompt injection as it ingests untrusted external data to drive design actions. - Ingestion points: Source code files (TypeScript, Kotlin, Swift) and user-provided descriptions of UI layouts.
- Boundary markers: The instructions do not define specific delimiters or security warnings for the ingestion of these external files.
- Capability inventory: Script execution in the Figma environment (
use_figma), design system search, and metadata inspection. - Sanitization: The workflow does not specify methods for sanitizing or validating the contents of the source code before the agent interprets it to build the Figma design.
Audit Metadata