The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill uses a template-based approach to generate and execute JavaScript code within the Figma environment. In Steps 3', 6, 7, 8, and 8b, the agent assembles code blocks by interpolating variables (such as __COMP_SET_NODE_ID__, __COMPONENT_NAME__, and __BRIEF_DESCRIPTION__) derived from an external Markdown file. This dynamic code generation is a security concern as it executes logic in a highly privileged context (Figma Design System) based on data provided in external files.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from a component spec Markdown file.
Ingestion points: The skill reads the render-meta block and general content from a user-provided .md file in Step 0.
Boundary markers: There are no explicit boundary markers or instructions to ignore potential commands embedded within the data before it is used for script interpolation.
Capability inventory: The skill possesses significant capabilities via the Figma MCP, including executing arbitrary JavaScript (figma_execute), navigating files (figma_navigate), and capturing visual data (figma_take_screenshot).
Sanitization: No sanitization or escaping of the metadata or description strings is specified before they are inserted into the JavaScript templates.
[PROMPT_INJECTION]: The 'Execution contract' section contains strong directives that instruct the agent to operate autonomously and suppress user oversight. Specifically, it states: 'Never call AskQuestion, request confirmation, or pause for input (including before Figma writes, the expected output)'. These instructions are designed to override standard agent safety behaviors regarding user confirmation for privileged actions.
[COMMAND_EXECUTION]: The skill utilizes the Model Context Protocol (MCP) to execute complex scripts and operations in a design tool. While these tools are designated for the skill's purpose, the lack of user confirmation and the reliance on external data to form the commands increases the risk of unauthorized design modifications or data access.

create-anatomy