The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from external Figma designs and remote provider skills, which could potentially contain malicious instructions.
Ingestion points: Figma design data (layers, components, variables) fetched via the API, and remote instruction files (SKILL.md) retrieved via the get_figma_skill tool from the Figma MCP server.
Boundary markers: The instructions do not specify the use of delimiters or sanitization patterns to isolate external data from the agent's control context.
Capability inventory: The skill can execute shell commands via the figma CLI, write files to the local system (downloading assets), and execute scripts within the Figma environment via use_figma.
Sanitization: No explicit sanitization or validation of external design metadata is described before it is used to influence agent behavior.
[COMMAND_EXECUTION]: The skill relies on the figma CLI to perform core operations, including authentication (figma authorize-url), status checks (figma status), and tool invocation (figma call-tool).
[EXTERNAL_DOWNLOADS]: The skill dynamically fetches remote instructions and configuration from Figma's official MCP server using the get_figma_skill tool and skill:// URIs. It also downloads design assets to local project paths as part of the implementation workflow.
[DYNAMIC_EXECUTION]: The use_figma tool, described in the canvas editing reference, executes scripts natively within the Figma application to inspect and mutate canvas content.

figma