The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download a prebuilt Figma plugin as a ZlP archive from the author's GitHub releases page.\n- [REMOTE_CODE_EXECUTION]: It references the execution of a local script scripts/figma-import-prep.mjs and instructions for building the plugin from source via npm run build:plugin.\n- [COMMAND_EXECUTION]: Automates Figma document manipulation using the use_figma and upload_assets MCP tools. The use_figma tool executes generated JavaScript code within the Figma workspace context.\n- [DATA_EXFILTRATION]: Describes network operations to upload image assets to mcp.figma.com, which is the established endpoint for the Figma MCP service layer.\n- [PROMPT_INJECTION]: The skill ingests untrusted external data from project files such as catalog.json and .design-parity.json. There are no explicit boundary markers or sanitization steps documented to prevent instructions embedded in these data files from influencing the agent's behavior during the import process. This creates an indirect prompt injection surface given the skill's capabilities to execute code via the Figma API.

figma-catalog-import