figma-create-design-system-rules
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection. It ingests data from an external Figma MCP server (via tools like
get_design_context) and incorporates it into generated rule files and code implementations. A malicious Figma file could potentially embed instructions to subvert the agent's behavior during code generation. - Ingestion points: Figma MCP server outputs (SKILL.md Step 3 and 4).
- Boundary markers: No explicit delimiters or warnings are defined to instruct the agent to ignore instructions embedded within the Figma design data.
- Capability inventory: The skill allows writing to project configuration files such as
CLAUDE.md,AGENTS.md, and.cursor/rules/(SKILL.md Step 4). - Sanitization: There are no instructions for sanitizing or filtering the content retrieved from the Figma API before it is processed.
- [COMMAND_EXECUTION]: The skill facilitates the creation and modification of project-level rule files. While this is the core function of the skill, the ability to modify agent instructions (like
.cursor/rules) based on external inputs constitutes a significant capability that should be monitored for misuse.
Audit Metadata