The Agent Skills Directory

[COMMAND_EXECUTION]: In Phase 1 of SKILL.md, user-controlled input from $ARGUMENTS is interpolated into a shell command: node <SKILL_DIR>/figma-scan.mjs "$PROJECT_ROOT" "<url-or-key>". Because the argument is placed inside double quotes in a shell environment, it is susceptible to command substitution (e.g., using $(...) or backticks), allowing for arbitrary command execution on the host system.
[EXTERNAL_DOWNLOADS]: The skill performs environment setup in Phase 0.3 by executing pnpm install. This involves downloading and installing external Node.js packages from the npm registry.
[CREDENTIALS_UNSAFE]: The skill requires a FIGMA_TOKEN personal access token provided through the environment. While the documentation provides instructions for secure handling, the use of sensitive credentials within a skill that executes shell commands and makes network requests increases the risk profile.
[DATA_EXFILTRATION]: The skill makes outbound network calls to api.figma.com. While this is the intended behavior for fetching design files, the combination of network access and credential usage requires careful monitoring.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it processes data from an external, potentially untrusted source (the Figma API).
Ingestion points: Data is fetched from api.figma.com by figma-scan.mjs and stored in scan-manifest.json.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are provided when passing this data to the design-analyzer subagent.
Capability inventory: The skill has the ability to write to the file system, execute shell commands, and perform network operations.
Sanitization: There is no evidence that Figma layer names, component descriptions, or other metadata are sanitized before being processed by the LLM, which could allow an attacker to embed malicious instructions within a Figma design file.

understand-figma