The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the Bash tool to run curl and jq commands for API interaction. These commands are formatted to retrieve structured design data and are used appropriately for the skill's stated purpose.
[EXTERNAL_DOWNLOADS]: Communicates with the official Figma API (api.figma.com) to download design information and temporary CDN links for image assets. Figma is a well-known service, and the data retrieved is restricted to design content.
[CREDENTIALS_UNSAFE]: Appropriately manages authentication by referencing an environment variable $FIGMA_TOKEN rather than hardcoding secrets, which is consistent with secure development practices.
[PROMPT_INJECTION]: As the skill ingests external data such as Figma comments and node names, it presents an indirect prompt injection surface. This is a standard operational risk for tools that process user-generated content from external platforms and is mitigated by the agent's internal safety filters.

figma