figcraft-html-import — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited figcraft-html-import (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when the deliverable is editable Figma layers generated from HTML, a local .html file, or a simple web URL.
FigCraft's native path converts HTML into a create_frame payload so the result stays inside the declarative pipeline: Opinion Engine, design preflight, lint, verification debt, and token/component workflows still apply.
import_html for static HTML, local HTML files, and simple server-rendered pages.filePath imports require .html, .htm, or .xhtml; by default they are limited to the MCP server cwd. Set FIGCRAFT_HTML_IMPORT_ROOTS to allow additional roots.http(s) pages. Private/loopback URLs such as localhost are blocked by default; set FIGCRAFT_HTML_IMPORT_ALLOW_PRIVATE_URLS=true only when intentionally importing a local/private page.dryRun:true first for unfamiliar HTML to inspect the generated create_frame payload.generate_figma_design as a pixel reference when available, then rebuild/refine through FigCraft tools.figma-create-ui.figcraft-code-connect; Code Connect's figma.html is not an HTML import path.get_mode first. If it fails, stop and ask the user to open Figma -> Plugins -> FigCraft.ui-ux-fundamentals, plus design-guardian when a library is selected or design-creator when no library exists.html.filePath.url; JavaScript is not executed.import_html({ ..., dryRun:true }) and inspect:childrenimport_html only after the payload looks reasonable.export_image on the returned root framelint_fix_allverify_design if _qualityScore < 80, _qualityWarning exists, or _verificationDebt remainsimport_html is conservative by design.
It supports:
main, section, article, header, footer, nav, div, forminput, textarea, selectimg URLs and inline svgIt does not currently support:
After import, prefer normal FigCraft edits:
nodes(method:"update") for layout, fills, strokes, sizing, and text props.text(method:"set_content") or text(method:"set_range") for content changes.search_design_system + variables_ep(method:"batch_bind") where appropriate.create_component_from_node or rebuild them via create_component.Dry-run a local file:
{
"filePath": "/absolute/path/page.html",
"name": "Imported / Pricing Page",
"width": 1440,
"dryRun": true
}Import an inline snippet:
{
"html": "<main><h1>Launch faster</h1><p>Design and ship with one system.</p><button>Start</button></main>",
"name": "Imported / Landing",
"width": 1200
}~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.