implement-design

Security checks across malware telemetry and agentic risk

Overview

This skill is an instruction-only Figma-to-code workflow that uses a Figma MCP server as disclosed and shows no hidden, persistent, or unrelated behavior.

Install if you intend to implement UI from Figma through a Figma MCP server. Be careful with the broad "generate code" trigger: use it for explicit Figma design work, and avoid providing Figma links or files you are not authorized to access.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger phrase "generate code" is overly broad for a highly privileged skill that can drive Figma MCP access and implementation behavior. This can cause unintended activation in unrelated coding requests, increasing the chance the agent invokes the skill in the wrong context, fetches external design data unnecessarily, or follows an irrelevant workflow that alters project code unexpectedly.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal