Anima Security Basics

What it does

When your agent uses it

• Protecting API credentials
• Restricting Figma access scope
• Hardening CI/CD design automation pipelines
• With: anima security

Example prompts

• “anima security”
• “anima token safety”
• “figma token security”
• “/anima-security-basics”

Requirements

• Node.js
• A credential in ANIMA_TOKEN
• A credential in FIGMA_TOKEN
• Compatibility (from SKILL.md): Requires Node.js 20+, approved Anima API access, current Anima SDK documentation, and authorized Figma or website source access
• Pre-approved tools (allowed-tools): Read, Write, Edit, Grep

Workflow steps

3 steps, taken from the step headings in SKILL.md.

1. 1Figma Token Scope Restriction
2. 2Server-Side Only Enforcement
3. 3Secret Manager Integration

What it can do on your machine

Read from SKILL.md and the folder at commit cfae287. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • Read
  • Write
  • Edit
  • Grep

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Shell commands in SKILL.md call:

  • node

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Links to these hosts (documentation or services it may open):

  • figma.com
  • cloud.google.com

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names these keys or tokens, usually read from environment variables:

  • ANIMA_TOKEN
  • FIGMA_TOKEN
  • FIGMA_FILE_KEY

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

• Compatibility

  Requires Node.js 20+, approved Anima API access, current Anima SDK documentation, and authorized Figma or website source access

  From compatibility in the SKILL.md frontmatter.

Context cost

Anima Security Basics loads about 1.6k tokens when it runs, and up to ~1.7k if it reads all its reference files. Until then it costs about 72 tokens; SKILL.md has 498 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~72

When it runs · the whole SKILL.md, loaded when a task matches

~1.6k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~1.7k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NoteMentions a .env fileSKILL.md:49

  nima token stored in secret manager (not .env in prod)

• NoteMentions a .env fileSKILL.md:52

  - [ ] `.env` files gitignored and chmod 600

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from jeremylongshore/tons-of-skills-marketplace at commit cfae287, republished under its MIT licence (© jeremylongshore). 498 words, ~1,550 tokens.

name

anima-security-basics

description

Audit and harden Anima and Figma tokens for design-to-code pipelines. Use when protecting API credentials, restricting Figma access scope, or hardening CI/CD design automation pipelines. Trigger with: "anima security", "anima token safety", "figma token security".

allowed-tools

Read, Write, Edit, Grep

compatibility

Requires Node.js 20+, approved Anima API access, current Anima SDK documentation, and authorized Figma or website source access

version

2.0.0

argument-hint

[pipeline-or-environment]

model

inherit

effort

high

license

MIT

author

Jeremy Longshore <jeremy@intentsolutions.io>

tags

saas, design, figma, anima, security

# When creating a Figma Personal Access Token:
# - Start with file_content:read for file/node content.
# - Add file_metadata:read, file_versions:read, or library read scopes only
#   when the selected endpoint requires them.
# - Do not use the deprecated broad files:read scope for new integrations.
# - Set an organization-approved expiration date.
# - Create separate tokens for dev vs CI environments

// src/anima/safety.ts
// Anima SDK is designed for server-side use only

function validateEnvironment(): void {
  if (typeof window !== 'undefined') {
    throw new Error('Anima SDK must run server-side only — never import in browser code');
  }
  if (!process.env.ANIMA_TOKEN) throw new Error('ANIMA_TOKEN not set');
  if (!process.env.FIGMA_TOKEN) throw new Error('FIGMA_TOKEN not set');
}

// Call this at startup
validateEnvironment();

// src/anima/secrets.ts
async function loadAnimaSecrets(): Promise<{ animaToken: string; figmaToken: string }> {
  const { SecretManagerServiceClient } = await import('@google-cloud/secret-manager');
  const client = new SecretManagerServiceClient();

  const [animaVersion] = await client.accessSecretVersion({
    name: `projects/${process.env.GCP_PROJECT}/secrets/anima-token/versions/latest`,
  });
  const [figmaVersion] = await client.accessSecretVersion({
    name: `projects/${process.env.GCP_PROJECT}/secrets/figma-token/versions/latest`,
  });

  return {
    animaToken: animaVersion.payload?.data?.toString() || '',
    figmaToken: figmaVersion.payload?.data?.toString() || '',
  };
}

export FIGMA_FILE_KEY="synthetic-staging-file"
node scripts/anima-preflight.mjs \
  --file-key "$FIGMA_FILE_KEY" \
  --node-id "1:2" \
  --check-token-scope \
  --assert-server-only \
  --redact-output

© jeremylongshore, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (references) in skills/.curated/anima-security-basics of jeremylongshore/tons-of-skills-marketplace.

• SKILL.md
• references/official-docs.md

Open the folder on GitHubat commit cfae287