Agent skill · security · jeremylongshore
anima-security-basics
Audit and harden Anima and Figma tokens for design-to-code pipelines.
Why this skill is useful
Provides specific code snippets and security practices for managing API tokens in design automation pipelines that the AI wouldn't reliably generate on its own.
What it needs
Requires @google-cloud/secret-manager installed locally. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Anima Security Basics Overview This workflow protects the Anima and Figma credentials used by a design-to-code pipeline while keeping generated output reviewable. It applies least privilege to the design source, keeps tokens on the server, and makes secret exposure or unexpected file access a fail-closed condition. Prerequisites A managed secret store and separate development, staging, and production bindings for ANIMATOKEN and FIGMATOKEN. An allowlist of Figma file keys and component node IDs, with an owner for each design source and a documented rotation/revocation contact. A non-production fixture and a disposable staging workspace for testing token scope, generated artifacts, and rollback behavior. Repository secret scanning and a deterministic generated-code directory; never use real customer or personal design data as the test fixture. Security Checklist [ ] Anima token stored in secret manager (not .env in prod) [ ] Figma token uses only the endpoint-required granular read scopes [ ] SDK runs server-side only (never ship tokens to browser) [ ] .env files gitignored and chmod 600 [ ] CI secrets stored in GitHub Secrets, not workflow files [ ] Generated code reviewed before committing (no embedded tokens) Instructions Step 1: Figma Token Scope Restriction Step 2: Server-Side Only Enforcement Error Handling Failure Required response --------- ------------------- Secret manager is unavailable or a required token is empty Abort before any Figma or Anima request; emit only a redacted reason and retry through the deployment system. A browser bundle imports the SDK or contains a token Fail the build, remove the artifact, and rotate any credential that may have been exposed. Figma returns an authorization or scope error Stop the run and review the file/node allowlist; do not broaden scopes automatically. A token is expired, over-scoped, or present in logs/artifacts Revoke and replace it through the managed store, then rerun the leak scan before enabling the pipeline. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/anima-security-basics