atomic-page-builder
Warn
Audited by Snyk on Mar 1, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). This skill explicitly requires extracting page specs from Figma (e.g., "Use Figma MCP: get_node" in SKILL.md and repeated throughout SKILL.extended.md), so the agent fetches and interprets external Figma file content which can materially influence build decisions and tooling (tokens, layout, component choices).
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.80). The skill mandatorily requires runtime fetching of page specs from Figma (e.g., via figma.get_node and URLs like https://figma.com/file/xxx?node-id=123), and those fetched Figma values directly determine the agent's instructions for layout and implementation, so this external URL is a required runtime dependency that controls the agent's behavior.
Audit Metadata