The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests variable names and values from external Figma files, which could contain malicious instructions if the file is attacker-controlled.
Ingestion points: Figma variable definitions and usage data are retrieved via figma_get_variables and figma_get_styles in SKILL.md Step 1.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are used when processing the variable data.
Capability inventory: The skill has the ability to write back to the Figma file using tools like figma_rename_variable, figma_update_variable, and figma_add_mode in SKILL.md Step 10, as well as general file system access via Bash tools.
Sanitization: There is no evidence of sanitization or validation performed on the ingested Figma variable content before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The skill documentation explicitly requires the 'Figma Console MCP (Desktop Bridge plugin)' by Southleft for full collection-wide auditing and remediation capabilities.
Evidence: Step 0 and Step 10 highlight that the 'official Figma MCP' is insufficient and direct the user to employ the third-party Southleft plugin. While Figma is a well-known service, the reliance on a specific third-party bridge plugin for core functionality constitutes an external dependency that the agent is instructed to use.

figma-variable-audit