The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from user-supplied Markdown files to generate design documentation, creating a vulnerability surface for indirect prompt injection. * Ingestion points: The component .md specification file provided by the user (Step 0). * Boundary markers: Absent. The skill parses the Markdown structure but does not employ sanitization or boundary enforcement for the text content being injected into executable scripts. * Capability inventory: The skill uses figma_execute and use_figma to run arbitrary JavaScript in Figma, which can modify design files, create instances, and access design data. * Sanitization: Absent. Content from the .md file is directly interpolated into JavaScript string templates (e.g., t.characters = '__COMPONENT_NAME__';), allowing potential breakout and execution of arbitrary code if the input content is maliciously crafted.
[DYNAMIC_EXECUTION]: The skill assembles JavaScript code at runtime by replacing placeholders in predefined templates with data extracted from the component's Markdown specification. This generated code is then executed in the Figma plugin environment.
[COMMAND_EXECUTION]: The skill utilizes Figma MCP tools to perform actions such as navigating files, searching for components, and modifying design nodes on the canvas. While these are intended functions, they represent a high-privilege capability that can be exploited if the input data is compromised.

create-api