{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "figma",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Local script and command execution: node skills/figma/scripts/verify-motion.mjs --reference <export.mp4> --rend"
    },
    {
      "file": "网络端点",
      "summary": "Declared external network access: Figma REST read-only endpoints (/v1/images batch export, /v1/files/:key/styles fallback, node tree, variable"
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact output: .media/images/ (frozen Figma rendered assets), .media/manifest.jsonl (provenance ledger), .media/index.md ("
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查：① 全量文件清单核对（含隐藏）= skills/figma/SKILL.md + skills/figma/scripts/verify-motion.mjs 共 2 个，与仓库 skills-manifest.json 记的 files=2 一致；② token 扫描（http(s) URL / fetch( / process.env / child_process / writeFile / API_KEY|TOKEN|SECRET）：URL 命中 0，process.env 命中 0，child_process 仅在 verify-motion.mjs（ffprobe/ffmpeg），fetch 命中 0；③ 逐条打开脚本核对 external_deps 提到的调用点真实存在；④ 把 SKILL.md 的功能声明与脚本实际能力对照，找夸大与出入。",
    "second_pass": [
      {
        "item": "FIGMA_TOKEN 是否真被读取并用于外发（橙档判定的关键证据）",
        "status": "ok",
        "detail": "SKILL.md 第 26 行给出预检（`[ -n \"$FIGMA_TOKEN\" ]` 或项目 .env），第 28–30 行给出取 token 的一次性设置与「never ask them to paste the token into the conversation」；第 36 行给出 401/403/429 的处置语义。读取与实际 REST 调用发生在官方 hyperframes CLI 侧，本 skill 的目录只声明并约束该行为——与 hyperframes-cli 同口径，故橙档依据记在 SKILL.md 的声明面，并注明执行主体。"
      },
      {
        "item": "Figma REST 的具体 host 能否在源码内定位",
        "status": "unlocatable",
        "detail": "SKILL.md 只写出路径（`/v1/images`、`/v1/files/:key/styles`），未出现 api.figma.com 或任何 host；连接器也未指名具体服务。故 external_deps.endpoint 按「仅路径」标注，不补写推测域名。"
      },
      {
        "item": "verify-motion.mjs 的外部接触面（是否有隐藏网络/凭证/越界写入）",
        "status": "ok",
        "detail": "全文 154 行只 import node:child_process / node:fs / node:os / node:path；调用为 execFileSync(\"ffprobe\", …)、execFileSync(\"ffmpeg\", …)、spawnSync(\"ffmpeg\", …) 三处，全部数组参数无 shell；无 fetch、无 process.env、无凭证；写入仅限 mkdtempSync(join(tmpdir(), \"verify-motion-\")) 下的临时图，结束 rmSync 清理。阈值与标定写在文件头注释里（忠实 min 20.3dB / 发散 min 5.0dB，默认阈值 15dB）。"
      },
      {
        "item": "「连接器不执行 shader、会压平」这一关键警告是否自洽（会不会是夸大）",
        "status": "ok",
        "detail": "Phase 5 段与 Phase 4 步骤 4 的例外说明互相印证：两处都指向「请用户原生导出」，且 Phase 4 明确 shader 轨道烘焙会静默丢 shader。属同一声明的两处一致陈述，非矛盾。"
      },
      {
        "item": "「分镜帧是关键帧而非幻灯片」是否只是口号",
        "status": "ok",
        "detail": "同一段给出可机械执行的规则：场景单元按尺寸（如 >1400×900）过滤、顺序按 absoluteBoundingBox.x、相邻帧按 name 再按几何相似匹配成元素链、每链一资产、批量导出分块（~4/次，26 场景 ≈52 次单资产调用是反面教材），并给出升级判据（同一 UI 逐帧 → 重建 app、把帧差当作交互）。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "d2f0bc7f34837da54ae22063772d75d75ce26477",
    "sha256": "22ae9717e5a193613a87624a053a24efd4bd09bc317294132a34c0cb3dbadab8",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-28/figma.tar.gz",
    "sha256": "22ae9717e5a193613a87624a053a24efd4bd09bc317294132a34c0cb3dbadab8",
    "commit": "d2f0bc7f34837da54ae22063772d75d75ce26477"
  },
  "original": {
    "github": "https://github.com/heygen-com/hyperframes/tree/main/skills/figma",
    "path": "skills/figma",
    "commit": "d2f0bc7f34837da54ae22063772d75d75ce26477"
  }
}