The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted design data from Figma, which serves as a potential indirect prompt injection surface.
Ingestion points: Data enters the skill's context via the Figma MCP tools or through manual JSON/text exports pasted by the user as described in references/01-figma-analysis.md and SKILL.md.
Boundary markers: While the skill normalizes data into an Intermediate Representation (IR) to decouple source and target models, it does not explicitly instruct the agent to ignore or delimit potentially malicious instructions embedded within Figma layer names, property values, or metadata.
Capability inventory: The skill utilizes the execute_code tool to perform complex mutations and component creation within the Penpot environment, guided by the processed external data.
Sanitization: The provided scripts (buildIR.js, migrateTokens.js) perform structural normalization, such as PascalCase conversion and grid snapping, but do not implement security-focused sanitization or filtering for adversarial prompt content.
Context: This injection surface is intrinsic to the skill's primary function of design migration. No evidence of intentional exploitation was detected.

penpot-migrate