hyperframes-figma
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill employs system binaries and project-specific CLI tools to manage design assets and verify animation fidelity.\n
- Execution of
ffprobeandffmpegwithinscripts/verify-motion.mjsfor motion energy analysis.\n - Use of
hyperframesCLI commands for asset, token, and component synchronization.\n- [EXTERNAL_DOWNLOADS]: The skill provides instructions for maintaining its components via external updates.\n npx hyperframes skills update figmais used to fetch and update skill dependencies from the vendor's repository.\n- [DYNAMIC_EXECUTION]: The skill generates executable content at runtime based on ingested design data.\n- Design motion context is normalized and converted into GSAP timeline scripts, which are then injected into the composition environment.\n
- Local execution of verification scripts via
nodeis part of the standard workflow.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external design data from Figma, presenting a surface for indirect instructions.\n - Ingestion points: Figma REST API responses and connector-provided design trees (referenced in
SKILL.md).\n - Boundary markers: None explicitly mentioned for isolating ingested text or metadata from the instruction flow.\n
- Capability inventory: Command execution, file system writes to
.media/, and script injection into the final composition.\n - Sanitization: The process relies on structural normalization without documented safety delimiters or content filtering for design-originated strings.
Audit Metadata