The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local Python script (figma-handoff.py) stored within the repository's scripts/ directory to facilitate the handoff process.
[DYNAMIC_EXECUTION]: The skill uses Python to dynamically process Figma design data, generate bundles, and run a local validator script (figma_validate.py) to check the integrity of the output.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external Figma URLs and handoff bundles. To mitigate the risk of malicious or malformed data influencing the agent, it defines a series of "Hard Gates" and verification requirements.
Ingestion points: Figma REST API data processed into design-summary.json, design-handoff.md, and nodes.json (referenced in references/current-guidance.md).
Boundary markers: The instructions mandate strict adherence to design-summary.json for measurements and require visual comparison against rendered frames to prevent "eyeballing" or guessing.
Capability inventory: Execution of a local Python CLI tool (figma-handoff.py) and validator script.
Sanitization: Use of strict visibility and opacity checks, bidirectional control inventories, and a zero-unmatched item requirement for implementations.
[DATA_EXPOSURE_EXFILTRATION]: The skill provides explicit guidance on the secure management of FIGMA_TOKEN. It forbids passing the token in chat or command arguments, requiring it to be handled as an environment variable within a trusted execution environment. This prevents accidental exposure in logs, prompt history, or version control.

figma-handoff