The Agent Skills Directory

[SAFE]: No security issues detected. The skill provides integration instructions for the official Figma platform and follows established developer practices for tool configuration.
[EXTERNAL_DOWNLOADS]: Connects to the official Figma MCP server at mcp.figma.com. This is a well-known technology service used according to the skill's primary design-to-code purpose.
[PROMPT_INJECTION]: The skill processes untrusted design data from Figma, creating a surface for indirect prompt injection. This is addressed by instructions to treat the data as a design reference rather than authoritative code.
Ingestion points: Design nodes, metadata, and screenshots fetched via MCP tools as described in SKILL.md and references/figma-tools-and-prompts.md.
Boundary markers: Not explicitly defined for the incoming Figma payload.
Capability inventory: The skill generates React/Tailwind code and handles asset downloads (including potential localhost sources for SVGs/images).
Sanitization: No explicit validation of the Figma data payload is mentioned.
[COMMAND_EXECUTION]: Provides instructions in references/figma-mcp-config.md for setting the FIGMA_OAUTH_TOKEN environment variable and updating shell configuration files (~/.zshrc, ~/.bashrc). These are standard developer setup procedures for managing authentication tokens for the tool.

figma