The Agent Skills Directory

[PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection because it is designed to ingest and process external, potentially attacker-controlled design files.
Ingestion points: The agent is instructed to read content from Figma (.fig) files, GitHub repositories, and existing HTML/CSS codebases across multiple files including agents/import-figma.mjs, agents/lib/ds-core.mjs, built-in-skills/import-from-html.md, and built-in-skills/import-from-github.md.
Boundary markers: Present. The skill includes explicit instructions for the agent to treat imported content as data and not as instructions to follow (e.g., in built-in-skills/import-from-figma.md and built-in-skills/import-from-html.md).
Capability inventory: The agent can execute shell commands (node, git, gh, nsl), perform file system operations (read/write/edit), and initiate network requests (fetch).
Sanitization: The logic in ds-core.mjs and the Figma importer parses structural data rather than executing raw file content directly, though the agent still processes the resulting text.
[EXTERNAL_DOWNLOADS]: The skill's scripts are configured to download essential runtime libraries from a well-known service if they are not found locally.
Evidence: agents/build-preview.mjs contains logic to fetch @babel/standalone, react, and react-dom from https://unpkg.com/. These are well-known and verified technology services.
[COMMAND_EXECUTION]: The skill relies on several shell-based tools to manage the design workflow.
Evidence: Instructions in references/claude.md, references/codex.md, and built-in-skills/import-from-github.md guide the agent to use node for internal scripts, gh for GitHub interaction, git for sparse clones, and tmux with nsl to serve design artifacts locally.

pma-design