The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses standard shell commands to manage Node.js dependencies.
Evidence: npm list, npm install, and npm info commands are used to manage the @animaapp/anima-sdk package.
[EXTERNAL_DOWNLOADS]: The skill downloads the official Anima SDK from the npm registry.
Evidence: Installs @animaapp/anima-sdk, which is the legitimate library for the Anima design-to-code service.
[INDIRECT_PROMPT_INJECTION]: The skill processes external design data from Figma to generate code, creating a potential surface for indirect injection if Figma files contain malicious patterns. However, the skill incorporates robust mitigations.
Ingestion points: Figma design nodes are ingested via the anima.generateCode API call in SKILL.md.
Boundary markers: The instructions explicitly mandate CI gates (lint, type checking) and human review of generated diffs in the 'Error Handling' section.
Capability inventory: The skill uses fs.writeFileSync to write generated content to the local filesystem.
Sanitization: The workflow requires a 'staged canary' approach where output is quarantined and reviewed against a baseline before being promoted to production.

anima-upgrade-migration