Turns ideas into live, full-stack web applications with editable code, built-in database, user authentication, and hosting. Anima is the design agent in the...
Security Analysis
high confidenceThe skill's requirements and runtime instructions are internally consistent with a design-to-code/hosting service: it only requires an ANIMA_API_TOKEN and instructs calls to the Anima MCP server, with no extra installs or unrelated credentials requested.
The name/description (design -> full-stack apps, Figma/URL flows, playgrounds) match the declared runtime requirements: a single ANIMA_API_TOKEN for an Anima MCP server connection. No unrelated binaries, credentials, or config paths are requested.
SKILL.md instructs the agent to create/playground/publish apps and to convert Figma/URLs into code via the Anima MCP server. That scope is appropriate for the described functionality. Important privacy note: these instructions necessarily transmit user-provided designs, website links, or project content to the remote Anima service (MCP). The skill does not request unrelated local files or extra environment variables, but it will upload data needed to build or clone apps — so users should not send proprietary secrets or sensitive data unless they trust the remote service and token.
This is an instruction-only skill with no install spec and no code files, so nothing is written to disk or fetched at install time. That minimizes install-time risk and aligns with the skill's described behavior.
Only one environment variable is required: ANIMA_API_TOKEN (declared as primaryEnv). This is proportionate for an API-driven design/hosting service. There are no unrelated secrets requested.
always is false and the skill does not request permanent system-wide presence or modify other skill configs. Autonomous invocation is allowed (platform default); this is expected for an agent-accessible integration but users should be aware the agent can call the Anima service when invoked.
Guidance
This skill appears coherent and only needs an ANIMA_API_TOKEN to call Anima's MCP server. Before installing or using it, consider: (1) Data privacy — the skill will send Figma files, website URLs, and any content you provide to the remote Anima service; do not upload proprietary source, secrets, or personal data unless you trust Anima and its hosting. (2) Token management — provide a least-privilege, revocable token and store it securely; rotate the token if you suspect misuse. (3) Test first — try non-sensitive examples to confirm behavior and endpoint trustworthiness. (4) Autonomous calls — the agent may invoke the service when asked; if you prefer explicit consent for each external call, ensure your agent prompts you before running flows that upload content. (5) Review Anima's privacy/terms and the linked homepage repository to verify who operates the MCP server you will contact.
Latest Release
v1.0.9
Reduce bundle to single file. Remove capability descriptions, returns tables, and explicit URLs.
More by @dannyshmueli
Published by @dannyshmueli on ClawHub
