figma-generate-design
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFE
Full Analysis
- [DYNAMIC_EXECUTION]: The skill generates and executes JavaScript code snippets through the
use_figmatool to interact with the Figma Plugin API. This execution is scoped to the Figma environment and is the intended mechanism for the skill's functionality. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external source code or descriptions provided by the user to determine the appropriate design system components and layouts to build in Figma.
- Ingestion points: User-provided source code files and design descriptions (referenced in Step 1).
- Boundary markers: None explicitly defined in the prompt instructions to isolate untrusted data.
- Capability inventory: The tool possesses the capability to modify Figma file contents, including creating frames, importing components, and binding variables (documented in Steps 3 and 4).
- Sanitization: The skill does not prescribe specific sanitization or validation logic for the input source code before it influences the generated Figma commands.
Audit Metadata