figma-generate-library
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows established design system architectures and Figma Plugin API best practices. It includes comprehensive documentation and scripts for variable management, component creation, and documentation layout without any malicious intent.- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it is designed to ingest and process data from external codebase files (such as CSS, Tailwind configs, and JSON tokens) during the discovery phase.
- Ingestion points: Codebase analysis scripts and references (e.g.,
discovery-phase.md) that scan for CSS variables, JSON theme objects, and platform-specific resources. - Boundary markers: The skill relies on clear structural definitions but does not explicitly use boundary markers for external data; however, it enforces mandatory user checkpoints after each phase to validate findings.
- Capability inventory: The skill uses
use_figmato perform scene mutations (creating pages, components, and variables) and writes build state to local temporary storage (/tmp/dsb-state-{RUN_ID}.json). - Sanitization: The workflow incorporates multi-step manual validation, requiring the user to approve token lists and component structures before they are applied.
Audit Metadata