The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill installs the official Figma Code Connect package from the npm registry.
Evidence: npm i -g @figma/code-connect in SKILL.md.
[COMMAND_EXECUTION]: The skill executes commands using the figma binary to manage project connections and parse files.
Evidence: Commands like figma connect publish and figma connect parse are documented for use.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external Figma URLs and files, which serves as a potential attack surface if those external sources contain malicious instructions.
Ingestion points: Figma URLs and local project files processed via figma connect create <figma-url> and figma connect parse in SKILL.md.
Capability inventory: Shell command execution via the figma CLI tool.
Boundary markers: No specific delimiters or safety instructions are provided to the agent for handling external file content.
Sanitization: The instructions do not specify any validation or sanitization for the content parsed from Figma.

figma