The Agent Skills Directory

Indirect Prompt Injection Surface: The skill is designed to ingest data from external Figma documents, including layer names, text characters, and component descriptions, which could serve as vectors for indirect prompt injection. This consideration is addressed by the skill's mandatory incremental workflow (Section 5) and the requirement to validate every modification using structure-based metadata or visual screenshots.
Dynamic Execution Capabilities: The primary purpose of the skill is to facilitate the generation and execution of JavaScript code within the Figma Plugin API sandbox. This gives the agent high-privilege access to modify documents. The skill manages this through a strict set of 'Critical Rules' and 'Gotchas,' including requirements for atomic operations, explicit Promise handling, and mandatory error recovery protocols to maintain document integrity.
Trusted Platform Integration: The skill connects to a Model Context Protocol (MCP) server at a well-known service endpoint (https://mcp.figma.com/mcp). This connection is an official integration point for Figma services and is used to provide the tool functionality described in the agents/openai.yaml configuration.

figma-use