anima-upgrade-migration

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's workflow directly calls anima.generateCode with FIGMA_FILE_KEY and FIGMA_TOKEN to pull content from external Figma files (user-generated, third-party design data), which the agent ingests and uses to generate and write code—so untrusted third-party content can materially influence actions.