The Agent Skills Directory

[COMMAND_EXECUTION]: Uses standard CLI commands (npx hyperframes, ffmpeg, ffprobe) for operational tasks. All commands are executed locally for asset processing and skill updates from the vendor's repository.
[EXTERNAL_DOWNLOADS]: Fetches updates and assets from official Figma REST APIs (figma.com) and the vendor's GitHub repository (github.com/heygen-com/hyperframes). These are trusted sources for this skill's functionality.
[CREDENTIALS_UNSAFE]: The skill correctly implements security best practices for secret management. It explicitly instructs users to set FIGMA_TOKEN in shell environments or .env files and warns against pasting tokens into the chat interface. It requests the minimum necessary scopes (Read-only).
[REMOTE_CODE_EXECUTION]: Contains an update mechanism (npx hyperframes skills update figma) which is a standard pattern for maintaining CLI-based agent skills from a trusted vendor.
[DATA_EXFILTRATION]: Uses an anonymous usage beacon for event tracking (npx hyperframes events --skill=figma-motion). This is documented as consent-gated and used for operational telemetry without sensitive data access.
[DYNAMIC_EXECUTION]: The script scripts/verify-motion.mjs uses spawnSync and execFileSync to call ffmpeg and ffprobe. This is used for local image/video comparison to verify import fidelity and does not process untrusted network input in an unsafe manner.

hyperframes-figma