The Agent Skills Directory

[COMMAND_EXECUTION]: The skill extensively uses the hyperframes CLI (a vendor-provided tool) to perform core functions like importing assets, tokens, and components. It also executes a local utility script scripts/verify-motion.mjs, which invokes system binaries ffmpeg and ffprobe using execFileSync and spawnSync to perform motion fidelity checks.
[REMOTE_CODE_EXECUTION]: The skill utilizes npx hyperframes commands to self-update and send telemetry events. This involves executing code from the vendor's package registry. The skill also generates JavaScript code at runtime for animation timelines (emitTimelineScript) which is subsequently injected as <script> tags.
[EXTERNAL_DOWNLOADS]: The skill fetches design data, image assets, and motion metadata from the Figma REST API. It also uses npx to download and update its own dependencies from package registries.
[CREDENTIALS_SAFE]: The skill demonstrates secure secret management practices by instructing users to provide the FIGMA_TOKEN via environment variables or .env files. It explicitly warns against pasting the token into the conversation and provides guidance on minimum necessary scopes (read-only).
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from external Figma files that could potentially contain malicious instructions embedded in layer names, descriptions, or metadata.
Ingestion points: Figma URLs and node trees fetched via the REST API.
Boundary markers: Not explicitly defined for the API response data, though the skill provides narrative feedback to the user.
Capability inventory: Command execution (hyperframes CLI, ffmpeg), file writing (local assets), and dynamic script injection.
Sanitization: The skill mentions sanitizing SVG assets during the export process.

figma