figma-code-connect-components
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection via external and local data sources.\n- Ingestion points: Design metadata including component names and properties are ingested via the
get_code_connect_suggestionstool, and local source code is read during the component matching phase (Step 2).\n- Boundary markers: The instructions do not define explicit delimiters or security markers to isolate untrusted data during processing.\n- Capability inventory: The skill has permissions to read the local filesystem and execute tool calls that update Figma mapping states.\n- Sanitization: The risk is mitigated by a mandatory human-in-the-loop step (Step 3) where the agent must present matches to the user for explicit confirmation before callingsend_code_connect_mappings.
Audit Metadata