The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation instructions specify running npx -y @gethopp/figma-mcp-bridge. This executes a third-party package directly from the npm registry without pinning a version or verifying the source code, posing a supply chain risk.
[DATA_EXFILTRATION]: The create_image tool takes a source parameter that accepts local file paths. This allows the AI agent to read any file on the local filesystem (e.g., configuration files, private keys) and upload them to a Figma document, effectively exposing sensitive local data.
[PRIVILEGE_ESCALATION]: The save_screenshots tool allows the agent to specify an outputDir using absolute paths. This grants the capability to write files to arbitrary locations on the host system, which could be used to overwrite system binaries, shell profiles (like .bashrc), or SSH keys to gain persistent or elevated access.
[COMMAND_EXECUTION]: Several tools accept raw path strings (source, outputDir) as arguments without explicit sanitization or path-boundary enforcement described in the documentation, allowing for potential directory traversal or unauthorized file access.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from Figma design files that could be controlled by an external attacker.
Ingestion points: Data is pulled into the agent's context through get_document, get_selection, get_node, and get_text_content.
Boundary markers: The instructions lack delimiters or system-level warnings to distinguish between design data and valid agent instructions.
Capability inventory: The agent possesses powerful capabilities including arbitrary file system read/write and the ability to modify project design files.
Sanitization: There is no mention of sanitizing or filtering Figma text content before it is processed by the AI.

figma-mcp-bridge