The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous shell commands for the agent to execute, including project directory creation, file copying via node -e, and execution of a local synchronization script (canvas-fig-sync.mjs).
[DYNAMIC_EXECUTION]: The synchronization script utilizes the kiwi-schema library to dynamically compile and decode binary schemas for the .fig file format. Additionally, SKILL.md contains node -e commands for cross-platform file system operations.
[INDIRECT_PROMPT_INJECTION]: As the skill is designed to ingest and transform existing React source code, CSS, and configuration files, it is vulnerable to indirect prompt injection where malicious instructions could be embedded in the processed data.
Ingestion points: React source files (.tsx, .js), style sheets (.css), and project configuration files (package.json, meta.json) in SKILL.md and canvas-fig-sync.mjs.
Boundary markers: None identified in the instructions for segmenting untrusted code during analysis.
Capability inventory: File system write access (fs.writeFileSync) and command execution capabilities via shell and Node.js are present in the provided scripts and instructions.
Sanitization: The canvas-fig-sync.mjs script implements path normalization and validation to mitigate directory traversal risks when resolving logical paths.
[EXTERNAL_DOWNLOADS]: The skill instructions include commands to install Node.js dependencies (npm install) and reference external font resources from Google Fonts. These are standard development practices and target well-known services.

react-to-figma-make