figma-catalog-import

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill involves the dynamic generation and execution of code strings through the use_figma tool. This is a functional requirement for interacting with the Figma API to place SVGs, update node properties, and manage the canvas structure based on design catalog data.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from local repository files, creating a surface for potential indirect prompt injection. * Ingestion points: catalog.json, .design-parity.json, and design-map.json (SKILL.md). * Boundary markers: No explicit delimiters or instructions to ignore embedded content are documented for the ingested JSON data. * Capability inventory: use_figma (code execution), upload_assets (file upload), and get_metadata (file and Figma metadata access). * Sanitization: No specific validation or sanitization logic for the ingested fields is described in the provided instructions.
  • [EXTERNAL_DOWNLOADS]: The skill references external resources, including a Figma plugin zip and GitHub repositories for the design-parity and compose-ai-tools projects. As these resources are owned by the skill author (yschimke) and hosted on well-known platforms, they are documented as safe vendor-related resources.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 11:05 AM