The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the hyperframes CLI for asset and token imports. It also executes a local Node.js script (verify-motion.mjs) which spawns ffmpeg and ffprobe to validate animation choreography against reference exports.
[EXTERNAL_DOWNLOADS]: The skill suggests running npx hyperframes skills update figma to maintain version freshness, which fetches code from external registries. It also retrieves media assets and metadata from Figma's official REST API.
[DATA_EXFILTRATION]: Usage beacons are implemented via npx hyperframes events to report skill execution status. These are described as anonymous and consent-gated telemetry.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted third-party content from Figma files and URLs.
Ingestion points: Node trees, styles, variables, and SVG vector data are ingested from Figma links (SKILL.md).
Boundary markers: While the skill lacks explicit markers to prevent the agent from obeying instructions found within Figma text nodes, it focuses on technical data mapping and asset freezing.
Capability inventory: Includes file system write operations for media assets, execution of platform CLI tools, and subprocess execution for media analysis.
Sanitization: Vectors are subjected to SVG sanitization during import, and the motion verification script uses strict regex validation for user-provided crop parameters.

figma