The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill includes an eval command and a corresponding MCP tool that allows for the execution of arbitrary JavaScript code within the OpenPencil environment. While intended for design automation using the Figma Plugin API, this functionality allows for runtime code generation and execution which could be abused if the agent is provided with untrusted code snippets or influenced by external data.- [INDIRECT_PROMPT_INJECTION]: The skill processes external .fig files through multiple inspection and analysis tools, creating a surface for indirect prompt injection. Malicious data or instructions embedded within design node names, metadata, or text layers could influence the agent's decision-making process during automated design workflows.
Ingestion points: Design data is ingested via the open_file, query_nodes, get_node, describe, and tree tools.
Boundary markers: No explicit boundary markers or instructions to treat design content as untrusted data were found.
Capability inventory: The skill has the ability to write to files (save_file), execute arbitrary code (eval), and perform network operations via the MCP server mode.
Sanitization: There is no evidence of content sanitization or validation of the design files before they are processed by the agent.- [EXTERNAL_DOWNLOADS]: The MCP server setup instructions recommend using npx to download and execute openpencil-mcp and openpencil-mcp-http from the NPM registry. These are external dependencies required for the skill's MCP functionality.- [COMMAND_EXECUTION]: The skill relies on shell command execution via bun and npx to interact with the design files and host the MCP server. This requires the agent to have shell access and the ability to spawn subprocesses.

open-pencil