The Agent Skills Directory

[SAFE]: The skill implements a modular architecture using adapters for different design tools, which is a standard and secure pattern for extending functionality.
[DATA_EXFILTRATION]: The skill reads from a local configuration file ${CLAUDE_PLUGIN_ROOT}/config.yaml to identify the preferred design tool. This is a legitimate use of the Read tool for environment-specific settings.
[COMMAND_EXECUTION]: The skill utilizes ToolSearch and dynamic tool invocation (e.g., {figma_prefix}__open_document) to interact with Figma. This is a standard Model Context Protocol (MCP) pattern for managing tool prefixes and does not involve arbitrary shell command execution.
[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it processes data from external design URLs (Figma/Penpot). Malicious text within a design could attempt to influence the agent's output format or subsequent steps.
Ingestion points: Figma design metadata and layout trees (Step 3 and 4).
Boundary markers: None identified in the prompt instructions.
Capability inventory: Bash, Read, ToolSearch (SKILL.md).
Sanitization: None identified; the skill relies on the agent's internal reasoning to parse the extracted data.

analyze-design