The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Figma text nodes and layer names during the scanning and matching process.
Ingestion points: scan_text_nodes and scan_nodes_by_types in SKILL.md are used to retrieve potentially attacker-controlled text from external design files.
Boundary markers: The instructions lack specific delimiters or instructions to the agent to ignore any command-like text found within the annotation descriptions.
Capability inventory: The agent uses tools from figma-mcp-rust to read selection, scan nodes, and apply annotations in the Figma environment.
Sanitization: No sanitization or validation logic is defined for the content extracted from the text nodes before it is processed by the agent.

annotation-conversion