The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill is a stub that uses npx skills add to download and install a full code payload from an unverified GitHub repository (nafiurrahmanniloy/figma-skill). The skill documentation explicitly mentions that it includes executable Python scripts, which will be run on the user's system once the external payload is installed.
[EXTERNAL_DOWNLOADS]: The skill triggers the download of instructions and executable scripts from an external GitHub account. Furthermore, its core functionality involves downloading image assets and design tokens from external Figma sources.
[COMMAND_EXECUTION]: The SKILL.md file contains several shell commands designed to be executed by the agent to detect file paths, check installation status, and perform the installation of the remote skill package via npx.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from external sources, specifically Figma Community resources and project files. There are no boundary markers or sanitization instructions provided in the stub to prevent malicious instructions embedded in these third-party designs from influencing the agent's behavior during code generation or token extraction.

figma-skill