The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The installation instructions direct the user to run an external package from an unverified source.
The skill uses npx -y @pactortester/figma-mcp-cached to download and execute the MCP server code.
The package @pactortester/figma-mcp-cached is hosted under an unverified third-party scope, which poses a supply chain risk.
[REMOTE_CODE_EXECUTION]: The skill facilitates the execution of remote code via the npx command at runtime.
Evidence: The configuration for MCP clients uses "command": "npx" with the argument "@pactortester/figma-mcp-cached", which downloads and runs the package whenever the server is started.
[INDIRECT_PROMPT_INJECTION]: The skill processes complex design data from external, third-party controlled Figma URLs, which can be used to inject malicious instructions into the agent's context.
Ingestion points: Data enters the agent's context through the figma_prepare_file and get_figma_data tools, which fetch content from arbitrary Figma design URLs.
Boundary markers: There are no explicit boundary markers or instructions to the agent to ignore potentially malicious embedded content within the design data structure.
Capability inventory: The skill has the capability to write files to the local file system via the download_figma_images tool and perform network requests to the Figma API.
Sanitization: No sanitization, filtering, or validation of the fetched design data (JSON tree) is specified before it is provided to the agent for analysis.
[DATA_EXFILTRATION]: The skill provides a tool that can write files to arbitrary locations on the local disk, which could be exploited if not properly constrained by the underlying server logic.
The download_figma_images tool accepts a localPath argument that supports absolute paths (e.g., "localPath": "/absolute/path/to/save"), potentially allowing the agent to write or overwrite files outside of the intended project scope.

figma-context-mcp-cached