figma-design-handoff
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches design variables and component specifications from Figma's official API (api.figma.com). This interaction is performed securely using environment variables for authentication.
- [COMMAND_EXECUTION]: Employs standard industry tools including npx style-dictionary and npx playwright for token transformation and testing. These operations are consistent with the skill's primary function.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from Figma artboards and API responses. 1. Ingestion points: Figma REST API (api.figma.com) and Figma Dev Mode MCP tools. 2. Boundary markers: The instructions do not define specific delimiters for separating Figma metadata from agent instructions. 3. Capability inventory: The agent is authorized to generate and write code files (TypeScript, CSS) based on design inputs. 4. Sanitization: Data mapping follows structured logic for variables and component properties, though no explicit sanitization of free-text design descriptions is specified.
- [SAFE]: No obfuscation, hardcoded credentials, or persistence mechanisms were identified. The skill demonstrates best practices for design handoff automation.
Audit Metadata