The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on dynamically constructing JavaScript code to be executed via figma_execute and use_figma tools. These scripts incorporate external, untrusted data (like Figma node names and variant properties) into string literals. If a component name or property contains characters like backticks or quotes, it could escape the string context and execute arbitrary logic within the Figma environment.
[PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection by processing data from external Figma files that may be controlled by a third party. Maliciously crafted node names or descriptions could influence the agent's behavior or the output generated in the spec.
Ingestion points: Figma node names, properties, and structural data are extracted from the design file in Step 4.
Boundary markers: There are no explicit boundary markers or instructions to the agent to sanitize or ignore instructions embedded in the design data.
Capability inventory: The skill has extensive capabilities including figma_execute, use_figma, figma_take_screenshot, and figma_navigate.
Sanitization: There is no evidence of escaping or validation logic for the external content before it is interpolated into the executable scripts or used for documentation.

create-voice