The Agent Skills Directory

[DATA_EXPOSURE]: The skill is designed to read local repository files, including source code (React components, CSS modules, Tailwind configurations) and static assets (PNG, SVG, JPG), to reconstruct them in Figma. This behavior is the primary function of the skill and is explicitly documented for the user.
[DATA_EXFILTRATION]: Instructions in SKILL.md (Rule 0) guide the agent to use the upload_assets tool to send local file bytes to Figma's submission endpoints. This is a standard part of the Figma MCP workflow to ensure visual parity by including real assets in the design file. Because the destination is an established design service (Figma) and the behavior is central to the skill's utility, this is considered a safe and intended operation.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect injection as it ingests untrusted data from the repository being processed.
Ingestion points: Reads React components, CSS files, and static assets from the user's local repository during Phase 1a (Analyze the prototype).
Boundary markers: The instructions do not define specific delimiters or "ignore previous instructions" guards when reading external code content.
Capability inventory: The agent can perform Figma design operations via use_figma and upload files to Figma via upload_assets.
Sanitization: There is no explicit sanitization step for text or metadata extracted from the code before it is used to generate Figma annotations or frame labels.
[EXTERNAL_DOWNLOADS]: The README.md provides standard installation instructions via git clone from the author's GitHub repository (alima-max/prototype-to-figma-skill). These are user-initiated setup steps and do not represent runtime remote code execution risk.

prototype-to-figma