anima-local-dev-loop
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and installs standard development packages including
@animaapp/anima-sdk,vite, anddotenvfrom the npm registry to facilitate the design-to-code workflow. - [INDIRECT_PROMPT_INJECTION]: The skill converts external Figma design data into executable source code, which constitutes a potential surface for indirect prompt injection if the source design files are maliciously crafted.
- Ingestion points: Design content is ingested via the
anima.generateCodefunction inscripts/generate-preview.tswhich fetches data from the Figma API. - Boundary markers: The skill does not implement specific boundary markers or instructions to the model to disregard instructions embedded within the design data.
- Capability inventory: The skill utilizes
fs.writeFileSyncto write generated code to the local filesystem and uses a Vite development server to execute and preview the output. - Sanitization: No sanitization or safety validation is performed on the code generated from the external Figma source before it is written to disk or previewed.
Audit Metadata