The Agent Skills Directory

[DATA_EXPOSURE]: The troubleshooting workflow in SKILL.md (Step 1) and references/verbose-request-inspection.md utilizes the curl -v command piped into tee figma-debug-trace.txt. This process captures the full HTTP request trace, which includes the X-Figma-Token header containing the user's Personal Access Token (PAT), and persists it in a plain text file on the local file system.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from the Figma REST API (such as node names and document structures), which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: API responses from api.figma.com are fetched and inspected in SKILL.md (Steps 1, 3, and 4).
Boundary markers: There are no explicit delimiters or instructions provided to the agent to ignore potentially malicious content within the API data.
Capability inventory: The skill utilizes Read, Grep, and Bash for network operations and script execution.
Sanitization: No sanitization or validation of the content within the API responses is performed before the data is processed by the agent.

figma-advanced-troubleshooting