figma-use
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [SAFE]: The skill is a pure documentation and instruction set (no-code) designed to guide an AI agent in using Figma MCP tools. It contains no executable scripts, external dependencies, or binary assets.
- [SAFE]: All instructions and code snippets follow Figma's official developer guidelines and include defensive programming patterns (such as font loading before text edits) to prevent runtime errors in the Figma environment.
- [PROMPT_INJECTION]: The skill inherently interacts with external data (Figma file content). While this creates a surface for indirect prompt injection if layer names or properties contain instructions, the skill mitigates this risk by requiring the agent to return and act upon structured data objects rather than directly executing data-derived strings.
- [DATA_EXPOSURE]: The skill facilitates the discovery of file metadata and structure, which is the intended functionality of a design automation tool. No patterns for exfiltrating sensitive environment data or credentials were found.
Audit Metadata