The Agent Skills Directory

[SAFE]: The skill encourages secure credential management by instructing users to store Figma Personal Access Tokens (PAT) as GitHub Secrets using the gh secret set command, preventing the risk of hardcoded credentials.
[COMMAND_EXECUTION]: The automation workflows rely on standard CLI tools including git for version control, gh for pull request management, and npm/node for script execution and dependency management.
[INDIRECT_PROMPT_INJECTION]: The skill establishes an automated pipeline for ingesting data from the external Figma REST API and committing it to the repository.
Ingestion points: Figma API data is processed via scripts/extract-figma-tokens.mjs and scripts/export-figma-icons.mjs as defined in SKILL.md.
Boundary markers: The workflows do not utilize specific delimiters to isolate ingested design data from the rest of the codebase.
Capability inventory: The workflow environment is granted capabilities to perform git push, create pull requests via gh pr create, and execute npm ci for dependency installation.
Sanitization: The skill implements a validation step in references/design-system-validation.md which uses Node.js and regular expressions to verify the structure and quantity of extracted design tokens, acting as a functional sanity check.
[DYNAMIC_EXECUTION]: An inline Node.js script (node -e) is used within the GitHub Action workflow to perform runtime validation of the generated CSS token files. This script is hardcoded for consistency checks and does not evaluate arbitrary external strings.

figma-ci-integration