The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to download the Bun runtime and a repository for the Figma integration.
Evidence: Fetches the Bun installation script from bun.sh via curl and powershell.
Evidence: Fetches the MCP server source code from a GitHub repository: https://github.com/grab/cursor-talk-to-figma-mcp.git.
[REMOTE_CODE_EXECUTION]: The setup process involves executing remote installation scripts and running the MCP server via package runners.
Evidence: The script uses the common pattern of piping a remote script to a shell for installation: curl -fsSL https://bun.sh/install | bash.
Evidence: The Cursor configuration uses bunx to execute the latest version of the MCP server: "args": ["cursor-talk-to-figma-mcp@latest"].
[COMMAND_EXECUTION]: The installation guide requires the execution of several shell commands to prepare the local environment.
Evidence: Instructions include running git clone, bun setup, and bun socket to initialize and start the WebSocket server.
[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface for indirect prompt injection by reading and processing data from Figma designs that may contain malicious instructions.
Ingestion points: Untrusted design data enters the agent context through tools such as get_document_info, read_my_design, and scan_text_nodes as seen in SKILL.md.
Boundary markers: The provided examples do not demonstrate the use of delimiters or specific instructions to the agent to ignore instructions embedded within the Figma designs.
Capability inventory: The skill grants the agent extensive capabilities to modify the design, including set_text_content, delete_node, modify_layout, and create_connections across multiple files.
Sanitization: There is no documentation of sanitization or validation logic for text content retrieved from Figma design nodes before it is interpreted by the agent.

figma-mcp-integration