figma

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill explicitly fetches and ingests user-created Figma content via the remote Figma MCP server (e.g., the "https://mcp.figma.com/mcp" MCP tool and link-based Figma frame/layer links documented in SKILL.md and references/figma-tools-and-prompts.md), and the agent is required to read and act on that untrusted, user-generated design data (get_design_context, get_screenshot, etc.), so third-party content can materially influence its actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill declares and uses the Figma MCP server at https://mcp.figma.com/mcp as a runtime tool (streamable_http) to fetch design contexts, generated React/Tailwind code and rule files which the agent ingests and follows, so the remote content can directly control prompts/instructions and is a required dependency.