The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute several shell commands using the Bun runtime, including bun install, bun extract, and bun run typecheck. These commands are used for dependency management, metadata retrieval, and code validation within the local development environment.\n- [EXTERNAL_DOWNLOADS]: The skill performs network operations to download Node.js packages from the npm registry and component metadata from the Figma API. These target well-known, legitimate services required for the tool's functionality.\n- [CREDENTIALS_UNSAFE]: The documentation mentions the need for a FIGMA_PERSONAL_ACCESS_TOKEN. However, it uses a placeholder value ("your-figma-token") in the examples, following safe documentation practices for credential management.\n- [PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it processes external metadata fetched from the Figma API. Evidence chain: 1) Ingestion point: src/main/data/__generated__/*.d.ts files generated from external API data; 2) Boundary markers: Not explicitly defined in instructions; 3) Capability inventory: Ability to execute shell commands via bun and write TypeScript files; 4) Sanitization: The skill relies on the TypeScript compiler to catch errors in the generated mapping files.

dev-figma-v3-migration-plugin