hyperframes-figma

Pass

Audited by Gen Agent Trust Hub on Sep 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill employs system binaries and project-specific CLI tools to manage design assets and verify animation fidelity.\n
  • Execution of ffprobe and ffmpeg within scripts/verify-motion.mjs for motion energy analysis.\n
  • Use of hyperframes CLI commands for asset, token, and component synchronization.\n- [EXTERNAL_DOWNLOADS]: The skill provides instructions for maintaining its components via external updates.\n
  • npx hyperframes skills update figma is used to fetch and update skill dependencies from the vendor's repository.\n- [DYNAMIC_EXECUTION]: The skill generates executable content at runtime based on ingested design data.\n
  • Design motion context is normalized and converted into GSAP timeline scripts, which are then injected into the composition environment.\n
  • Local execution of verification scripts via node is part of the standard workflow.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external design data from Figma, presenting a surface for indirect instructions.\n
  • Ingestion points: Figma REST API responses and connector-provided design trees (referenced in SKILL.md).\n
  • Boundary markers: None explicitly mentioned for isolating ingested text or metadata from the instruction flow.\n
  • Capability inventory: Command execution, file system writes to .media/, and script injection into the final composition.\n
  • Sanitization: The process relies on structural normalization without documented safety delimiters or content filtering for design-originated strings.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 12, 2026, 11:22 AM