figma-catalog-import
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The skill involves the dynamic generation and execution of code strings through the
use_figmatool. This is a functional requirement for interacting with the Figma API to place SVGs, update node properties, and manage the canvas structure based on design catalog data. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from local repository files, creating a surface for potential indirect prompt injection. * Ingestion points:
catalog.json,.design-parity.json, anddesign-map.json(SKILL.md). * Boundary markers: No explicit delimiters or instructions to ignore embedded content are documented for the ingested JSON data. * Capability inventory:use_figma(code execution),upload_assets(file upload), andget_metadata(file and Figma metadata access). * Sanitization: No specific validation or sanitization logic for the ingested fields is described in the provided instructions. - [EXTERNAL_DOWNLOADS]: The skill references external resources, including a Figma plugin zip and GitHub repositories for the
design-parityandcompose-ai-toolsprojects. As these resources are owned by the skill author (yschimke) and hosted on well-known platforms, they are documented as safe vendor-related resources.
Audit Metadata