The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads screenshots and brand assets using curl. The source URLs are provided by the official Figma MCP plugin, which is a trusted service for this workflow.\n- [COMMAND_EXECUTION]: The skill uses benign shell commands like mkdir, find, and du to create directory structures and report on the status of generated files within the local environment.\n- [PROMPT_INJECTION]: The skill includes built-in mitigations for potential indirect prompt injection from design files. It features a dedicated sanitization module in the preview logic to prevent malicious markup execution.\n
Ingestion points: Figma design metadata, page structures, and component context retrieved through the official MCP interface.\n
Boundary markers: The skill treats Figma data as structured design tokens rather than instructions, although it lacks explicit prompt-level delimiters.\n
Capability inventory: Local file writes to .design/, folder creation, and network access via curl.\n
Sanitization: The preview.js file implements the sanitizeActiveMarkup function, which strips script, iframe, and on* event handlers from generated HTML markup before rendering.

figma2design