The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection due to its primary function of processing and auditing untrusted external content.
Ingestion points: The agent ingests user requests, local HTML/CSS files, and complex Figma design data (SKILL.md, references/figma-workflow.md).
Boundary markers: Absent; instructions do not explicitly direct the agent to ignore or isolate instructions that may be embedded within the design files or code it is tasked to audit.
Capability inventory: The skill can execute arbitrary JavaScript in the Figma desktop context (figma_execute), evaluate code in a browser (preview_eval), and deploy content to production environments via Firebase (references/figma-creation.md, references/deployment.md).
Sanitization: Absent; there are no defined protocols for escaping or filtering untrusted data retrieved via MCP tools before processing.
[COMMAND_EXECUTION]: The skill generates and executes dynamic code to automate design tasks, which is the primary intended utility.
The framework uses figma_execute to run scripts within the Figma plugin environment and preview_eval for browser-based testing (references/figma-creation.md, references/deployment.md).
While these capabilities are powerful, they are well-documented and essential to the skill's primary purpose of providing a virtual design team workflow.

design