figma-use-figjam — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited figma-use-figjam (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill contains FigJam-specific context for the use_figma MCP tool. The figma-use skill provides foundational context for plugin API execution via MCP as well as the full Figma plugin API for more advanced use-cases that are not described here.
Always include `figma-use-figjam` in the comma-separated `skillNames` parameter when calling `use_figma` for FigJam operations. If this skill was loaded via an MCP resource, you MUST prefix the name with `resource:` (e.g. `resource:figma-use-figjam`). This is a logging parameter used to track skill usage — it does not affect execution.
FigJam URL is `figma.com/board/...`. Do NOT callfigma.createPage()in FigJam — it throwsTypeError: figma.createPage no such property 'createPage' on the figma global object.createPage()is a Design-file API only (figma.com/design/...). FigJam files have a single implicit page; organize content with sections instead (see create-section).
`get_figjam` is the inspection tool for FigJam files. It returns the full node tree as XML, including IDs of pages, sections, stickies, connectors, and other nodes you need to reference in subsequent use_figma calls.
use_figma code that needs to reference existing nodes (page IDs, section IDs, etc.). Don't try to discover IDs by running an inspection script — console.log output from use_figma is not returned to the agent (see figma-use Critical Rule #4). Only the return value comes back.get_figjam first.return an ID from a previous use_figma call and need it now, call get_figjam rather than re-running an inspection script.Load only the references your task needs — but when you do need to load multiple, issue all reads in a single parallel tool-call batch, not sequentially across turns. For a typical board-creation task, that means a single message containing reads for plan-board-content plus the 3-4 specific node-type references you'll use.
The Figma MCP tools (use_figma, get_figjam, get_screenshot, get_metadata, create_new_file, whoami) often appear as deferred tools that require ToolSearch to load their schemas before they can be called. Load all schemas in a single `ToolSearch` call using the select: syntax instead of one call per tool:
ToolSearch query="select:use_figma,get_figjam,get_screenshot,get_metadata,create_new_file"Six sequential ToolSearch calls is six round trips before any work happens. One batched call is one round trip.
Every FigJam text mutation (sticky/shape/label/table cell/connector text, standalone text nodes) follows the same recipe as Design files: load font → await → mutate → return affected IDs. Skipping the load throws Cannot write to node with unloaded font "<family> <style>". See figma-use → gotchas.md → Canonical text-edit recipe. FigJam-specific note: sublayer defaults vary (sticky → Inter Medium, shape → Inter Medium, connector → invalid until set), so always load from node.text.fontName rather than hardcoding { family: 'Inter', style: 'Regular' }.
`upload_assets` is the ONLY supported way to add images to a FigJam file. Do NOT use figma.createImage() or figma.createImageAsync() from inside use_figma — they are unsupported as image-upload entry points in FigJam. Call upload_assets with the FigJam fileKey; the tool returns single-use upload URLs that you POST raw image bytes to, and the image is committed and placed automatically. Pass nodeId (with count: 1) to attach the upload to an existing FigJam node as a fill; omit nodeId to drop the image onto the board as a new layer.
For the full request/response shape, see figma-use → api-reference.md → Images.
hex/255 notation rule and the h() helper~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.