figma-code-connect-components
Pass
Audited by Gen Agent Trust Hub on Mar 25, 2026
Risk Level: SAFE
Full Analysis
- Indirect Prompt Injection Surface: The skill processes external metadata from Figma components and reads local source code files to suggest mappings. As with any skill that ingests external data, there is a potential surface for indirect instructions to be embedded in component names or code comments, though the skill's capabilities are focused on mapping rather than arbitrary execution.
- Local Script Execution: A Python script (
normalize_node_id.py) is included to convert Figma node identifiers between URL and tool formats. This script performs basic string manipulation and does not involve risky operations like network access or dynamic code evaluation. - External Service Integration: The skill connects to the official Figma MCP server (
mcp.figma.com) to retrieve design data. This communication is restricted to the intended purpose of the skill and uses the established Figma infrastructure. - File System Access: The skill searches for component files in common project directories (e.g.,
src/components/). This access is necessary for its primary function and is guided by specific user-provided context regarding the project structure.
Audit Metadata