The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text content and node names from external Figma designs to perform audits. This data is processed and presented without sanitization, creating a surface for indirect prompt injection.\n- Ingestion points: The skill reads design data from /tmp/a11y_text_scan.json, which is populated via the figma-ai-bridge plugin.\n- Boundary markers: No specific boundary markers or 'ignore' instructions are used to delimit untrusted data in the analysis workflow.\n- Capability inventory: The skill possesses the capability to write annotations back to the Figma document using the set_multiple_annotations command.\n- Sanitization: The Python analysis script performs no sanitization or escaping of the ingested text content before it is displayed or prepared for annotations.\n- [COMMAND_EXECUTION]: The workflow involves constructing shell commands where JSON data derived from the design is interpolated into single-quoted strings.\n- Evidence: The workflow instructs the agent to execute: node scripts/figma_cmd.mjs set_multiple_annotations '{"nodeId":"","annotations":<annotations_array>}'.\n- Risk: If the annotations_array (which contains strings derived from Figma text nodes) includes single quotes, it could potentially escape the shell string and lead to unauthorized command execution.

a11y-audit