The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill correctly instructs users to store Figma personal access tokens and file keys in a .env file, which is a standard and safe practice for secret management. The example token provided (figd_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx) is a non-functional placeholder and does not constitute a credential leak.
[DATA_EXFILTRATION]: All network operations (fetch calls) target the official Figma API domain (https://api.figma.com/v1). There are no attempts to send sensitive information to unauthorized third-party domains.
[INDIRECT_PROMPT_INJECTION]: The skill ingests design data from Figma files (SKILL.md). However, this data is processed as structured JSON to extract design tokens or export assets. No untrusted data from the Figma API is interpolated back into a natural language prompt in a way that could influence the agent's behavior, and the skill lacks dangerous capabilities like arbitrary command execution.

figma-api