vibefigma
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the vibefigma CLI tool through the npx command, which is the primary mechanism for design-to-code conversion.
- [EXTERNAL_DOWNLOADS]: The vibefigma package is retrieved from the npm registry when the npx command is invoked by the agent.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from Figma URLs. Ingestion points: Figma design nodes via URL. Capability inventory: npx command execution and file writing to the project directory. Boundary markers: No explicit boundary markers are provided in the instructions for the design data processing. Sanitization: The skill does not specify sanitization for the generated component code, though the risk is minimal as this behavior is core to the skill's functionality.
Audit Metadata