The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data from the Figma REST API and user-supplied Figma URLs, which represents an indirect prompt injection surface.
Ingestion points: Figma file keys, node IDs, and API responses containing design structures (File: SKILL.md).
Boundary markers: The skill instructs the agent to use parseFigmaRef for URL processing and implements localized asset freezing.
Capability inventory: The skill uses the hyperframes CLI for file operations and registry management, and invokes ffmpeg/ffprobe via a local script.
Sanitization: Includes specific instructions for sanitizing SVG assets.
[COMMAND_EXECUTION]: The included script scripts/verify-motion.mjs executes system binaries ffmpeg and ffprobe using execFileSync and spawnSync to compare motion energy deltas. These calls are part of a controlled fidelity validation workflow and do not utilize a shell, reducing injection risks.
[EXTERNAL_DOWNLOADS]: The skill suggests using npx hyperframes skills update figma to maintain version freshness, which involves downloading updates for the skill and its core dependencies from the HyperFrames ecosystem.

figma