The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external Figma designs, which can contain malicious instructions hidden in text layers, node names, or Dev Mode annotations.
Ingestion points: Untrusted data enters the agent context through tools like get_design_context, component_map, and token_map which retrieve data from Figma URLs (SKILL.md).
Boundary markers: The instructions lack explicit delimiters or warnings to ignore embedded instructions within the design data (e.g., text content or developer annotations).
Capability inventory: The skill generates executable code and instructs the agent to run build and preview commands such as pnpm build or next build (references/verify.md).
Sanitization: There is no evidence of sanitization or filtering applied to external design content before it is interpolated into code or prompts.
[COMMAND_EXECUTION]: The verification workflow requires the agent to execute shell commands to build and preview the project.
Evidence: The file references/verify.md explicitly lists commands like pnpm build, pnpm preview, and next build && next start as part of the visual verification process.
[EXTERNAL_DOWNLOADS]: The skill downloads external assets (images, icons, and screenshots) from Figma's infrastructure during the codegen process.
Evidence: The tools save_image_fills and icon_map are used to fetch and save remote assets (references/assets-and-icons.md).

figma-codegen