The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/run_agentic_request.py provides a mechanism for the agent to invoke external commands as part of a structured request workflow. This tool is designed with safety in mind, implementing SHA256 integrity checks for request payloads and verifying that input paths are plain files (not symbolic links) before they are processed.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from Figma files, codebases, and product documents, which represents a typical attack surface for indirect prompt injection. To mitigate this, the skill mandates a 'zero-trust' posture for all ingested artifacts, requiring manual or visual confirmation before any data is promoted from 'STALE' to 'PASS'.
[DYNAMIC_EXECUTION]: The skill contains logic for its own 'improvement-policy', which involves evaluating potential changes to the skill's own code and assets. This process is strictly controlled by the mise task runner and includes deterministic non-regression checks and automated restoration of previous versions if any safety or correctness metric fails.
[EXTERNAL_DOWNLOADS]: The skill fetches necessary JSON schemas and tool updates from well-known repositories (e.g., jdx/mise). These operations use secure protocols and target official project sources, representing standard maintenance behavior for developer-oriented tools.

figma-code-connect-design-system