The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes shell commands to manage files and directories for visual reports. It specifically uses mkdir for directory creation, cp for moving screenshots, and a custom bash script to interface with the Figma API. These commands are scoped to the project's report directory and include logic to prevent path traversal.
[EXTERNAL_DOWNLOADS]: The skill downloads design assets from Cloudflare-protected Figma endpoints (api.figma.com). These downloads are authenticated and directed to a well-known, trusted design service, fulfilling the core functionality of the skill.
[CREDENTIALS_UNSAFE]: For API access, the skill requires a Figma access token. The documentation provides secure guidance for users, instructing them to store the token in a .env file at the repository root and to ensure this file is ignored by version control systems via .gitignore.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from Figma URLs and local project context to generate report metadata and file slugs. Potential injection risks from these external sources are mitigated by input validation regex patterns in the helper scripts, which restrict characters in file keys and node IDs to safe alphanumeric sets.
[SAFE]: The interactive HTML report asset includes a strict Content Security Policy (CSP) that restricts script execution and image loading to safe sources, protecting the user when viewing the generated comparison reports.

design-compare