The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through the processing of untrusted input.
Ingestion points: The optionalContext parameter (described as free-form user string) and the {cachePath}/{componentSlug}-_base.json file (external data source).
Boundary markers: No explicit boundary markers or 'ignore' instructions are defined to isolate untrusted data from the reasoning logic.
Capability inventory: The skill possesses the ability to execute code via figma_execute and use_figma MCP tools and has write access to the local file system.
Sanitization: There is no evidence of sanitization or strict validation performed on the user-supplied context or the fields read from the JSON file before they are used in the interpretation layer.
[COMMAND_EXECUTION]: The 'Step 3-delta' mechanism explicitly instructs the agent to generate and execute JavaScript code snippets. Although the instructions mandate that these calls be 'read-only', the agent is dynamically constructing executable code based on its reasoning, which can be influenced by the aforementioned untrusted ingestion points.

extract-structure