The Agent Skills Directory

[PERSISTENCE]: The references/figma-mcp-config.md file provides instructions to modify shell profile files, specifically ~/.bashrc and ~/.zshrc, to persist the FIGMA_OAUTH_TOKEN. Modification of shell profiles is a common persistence mechanism used to maintain state across sessions.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted design data from external Figma URLs, which serves as an attack surface for indirect prompt injection.
Ingestion points: The agent fetches node metadata and design context using tools described in SKILL.md and references/figma-tools-and-prompts.md.
Boundary markers: There are no specific instructions or delimiters mentioned to isolate Figma-provided content from the agent's core instructions.
Capability inventory: The agent is authorized to generate and implement code (React/Tailwind) within the local repository based on the data retrieved.
Sanitization: No sanitization or verification steps are outlined for the data retrieved from Figma node names, descriptions, or variables.
[DATA_EXFILTRATION]: The instructions in SKILL.md direct the agent to directly access localhost sources if provided by the remote Figma MCP server for assets. This behavior can be exploited for local network probing or Server-Side Request Forgery (SSRF) if the remote server returns malicious local loopback addresses.
[EXTERNAL_DOWNLOADS]: The skill initiates connections to the official Figma MCP server at https://mcp.figma.com/mcp. While this is a reference to a well-known service, it involves fetching and processing data from a remote endpoint at runtime.

figma