design-system-governance-workflow
Pass
Audited by Gen Agent Trust Hub on Mar 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Communicates with the official Figma REST API (api.figma.com) to fetch design tokens and variables using user-provided credentials.- [EXTERNAL_DOWNLOADS]: HTML report templates reference external visual assets and utility libraries from well-known services including Google Fonts, Tailwind CSS, and Unpkg.- [COMMAND_EXECUTION]: The orchestrator script (scripts/run_pipeline.py) executes internal Python sub-scripts using subprocess calls with hardcoded paths to perform audits, refactoring, and code synchronization.- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it processes external design data; the ingestion point is in scripts/run_pipeline.py (Figma API and JSON files), it employs structured JSON parsing and delimited templates as boundary markers, possesses capabilities for subprocess execution and file writing, and applies sanitization through standard JSON serialization.
Audit Metadata