generate-tokens-from-figma — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited generate-tokens-from-figma (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Always run this as a two-phase workflow:
Use figma-use read-only scripts for Figma inspection. Do not mutate the Figma file. If the requested output format is not specified, use the bundled default template at templates/dtcg-2025-10.tokens.template.json and the mapping guidance in references/dtcg-2025-10.md.
Before inspecting Figma or generating tokens, run:
<skill-dir>/scripts/check_dependencies.shThis preflight checks:
figma-use.If Figma skills are missing, stop and guide the user to install them using Figma's official instructions: Figma skills for MCP. Tell the user that Figma documents the Figma plugin path as the easiest setup when their agentic tool supports it, and manual skill download/install as the manual alternative.
If Python is missing, install it automatically with the available platform package manager. The preflight script tries Homebrew on macOS, then common Linux package managers. If no supported package manager exists or installation needs user approval, continue only after Python is available.
Create both report files in the user's chosen output directory, defaulting to the current workspace:
figma-token-report.mdfigma-token-report.jsonThe report must include:
Normalization rows must include:
{
"kind": "variable|style|mode|collection|file",
"source": "Colors|Text Styles|Paint Styles|...",
"originalName": "Large Title/Regular",
"normalizedName": "large-title-regular",
"collision": false,
"collisionOf": null
}Use scripts/generate_figma_tokens.py to generate token files from figma-token-report.json.
Default outputs:
tokens/variables/<normalized-collection>.tokens.json, one file per variable collection.tokens/styles/color.tokens.json, generated from local paint/color styles.tokens/styles/text.tokens.json, generated from local text styles.Only generate other style types, such as effects or grids, when the user explicitly requests those style types.
Figma variable modes must become normalized groups inside each collection file. For example, a Colors collection with Light, Dark, and IC - Light modes becomes a colors.tokens.json file with light, dark, and ic-light groups.
Normalize every generated token, group, mode, file, and style name:
-. Separators include whitespace, /, _, punctuation separators, - , / , and repeated separator characters.-.-.token.On collisions after normalization, append -2, -3, etc. Record the collision in figma-token-report.md, figma-token-report.json, and the final response.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.