The Agent Skills Directory

[SAFE]: The skill performs network operations exclusively to official Figma endpoints (api.figma.com, www.figma.com) and the author's official domains (intentsolutions.io, jeremylongshore.com, tonsofskills.com). These are considered well-known or vendor-owned services and do not represent a security risk.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external API responses, which constitutes a potential attack surface for indirect prompt injection.
Ingestion points: API response headers (e.g., Retry-After) and response bodies processed in SKILL.md and referenced scripts.
Boundary markers: None present in the instructions to separate API data from agent instructions.
Capability inventory: The skill uses the Bash tool to execute curl commands and jq for parsing.
Sanitization: There is no explicit sanitization of the content returned by the external API before it is processed by the agent.
[SAFE]: The diagnostic script provided in SKILL.md and references/quick-diagnostic-script.md checks for the presence and length of the FIGMA_PAT environment variable but does not output the secret value itself, which is a safe debugging practice.

figma-common-errors