The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes design data from an external source (Figma) via the Anima SDK to generate code, which represents a potential surface for indirect prompt injection or malicious design input.
Ingestion points: Data returned from the Anima SDK's generateCode method in scripts/generate-components.ts.
Boundary markers: The workflow is designed to create a Pull Request for human review rather than merging automatically, providing a critical security checkpoint.
Capability inventory: The script uses fs.writeFileSync in scripts/generate-components.ts to save generated files and gh pr create in the CI workflow to submit changes.
Sanitization: The workflow includes npx eslint --fix to validate and format the generated output, though primary safety relies on the manual Pull Request review process described in the instructions.
[SAFE]: The skill demonstrates safe credential handling by using GitHub Secrets and environment variables (ANIMA_TOKEN, FIGMA_TOKEN) instead of hardcoding sensitive information.
[SAFE]: The integration utilizes the official @animaapp/anima-sdk and standard GitHub Actions, which are well-known and reputable services in the design-to-code ecosystem.

anima-ci-integration