The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The installation guide requires cloning a repository from an unverified personal account (kingkongshot) that is not recognized as a trusted organization or vendor.
[COMMAND_EXECUTION]: The setup process involves running npm install and npm run dev, which executes scripts and binary content from the cloned repository on the user's system.
[REMOTE_CODE_EXECUTION]: By facilitating the download and execution of code from an external, unverified GitHub repository, the skill creates a path for potential remote code execution.
[PROMPT_INJECTION]: The skill converts Figma design nodes into content for LLM processing, creating an attack surface for indirect prompt injection.
Ingestion points: Figma node data (text, layer names, and properties) processed by the bridge-pipeline and plugin code described in SKILL.md.
Boundary markers: Absent in the provided code examples; design data is directly stringified into prompts.
Capability inventory: Local file system access for writing generated code to output/ and debug/ directories, and running a local server on port 7788.
Sanitization: No evidence of sanitization or filtering of Figma text content before it is processed or passed to an LLM.

figma-bridge-html-export