figma-generate-library
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external codebase data (such as design tokens and configuration files) to automate Figma library construction, creating a surface where malicious instructions in those files could attempt to influence agent behavior.\n
- Ingestion points:
references/discovery-phase.mddescribes analyzing codebase files like*.tokens.json, CSS variables, and Tailwind configurations.\n - Boundary markers: No specific delimiters or safety instructions are defined for processing external codebase content.\n
- Capability inventory: The skill utilizes the
use_figmatool, which allows the agent to create and modify pages, variables, and components in Figma.\n - Sanitization: The skill does not describe explicit sanitization for data extracted from codebase files before use in Figma API calls.\n- [DYNAMIC_EXECUTION]: The skill generates and executes JavaScript scripts for the Figma API based on provided templates and logic.\n
- Evidence: The skill uses
use_figmato execute JavaScript generated from local templates and extracted tokens, as detailed in thescripts/folder andreferences/component-creation.md. This is the intended functional mechanism of the skill.
Audit Metadata