ui-design-to-code — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ui-design-to-code (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill to turn a UI preview image, screenshot, Figma MCP node dataset, Figma screenshot, or hybrid Figma+image source into traceable design-decoding artifacts, a platform-neutral UI node tree, cross-platform node data, and optionally maintainable implementation workflows for iOS, Web, Android, or other platform adapters. In codegen-with-auto-review mode, the goal is to recreate the visual effect of the source image or Figma screenshot with target-platform code, then verify it with runtime screenshots and visual comparison.
Core rule: do not generate platform code directly from a bitmap or raw Figma JSON. First build a Design Source Manifest, normalize source-specific data, then build a platform-neutral semantic node tree, then cross-platform node data, then map through an explicit platform adapter contract.
Traceability rule: every semantic node must trace back to grouped candidate IDs, and every grouped candidate must trace back to raw primitive IDs. If a future platform adapter cannot map the node tree without re-reading the source image, the decoding artifacts are incomplete.
Coordinate rule: every artifact must declare its coordinate system. Source-image pixel coordinates and Figma canvas coordinates use a top-left origin and must remain traceable even when logical units are inferred.
Figma asset wrapper rule: when a named Figma wrapper node such as ic_*, icon_*, img_*, logo_*, avatar_*, or thumbnail_* contains an internal vector/image, export and implement the wrapper node itself. Preserve the wrapper bbox, inner graphic bbox, content insets, parent layout, and sibling text relationships. Do not download or place the internal vector as the final icon when the wrapper exists.
Figma design notes rule: Figma REST ingestion must fetch file comments when possible and scan node text for annotation/callout/spec labels, including connected note labels. Generated platform code and target IR must read figma/figma-design-notes.json and treat those notes/comments as requirements unless explicit user instructions override them.
Artifact lifecycle rule: every generated intermediate artifact must live inside a single run directory with a run manifest, retention policy, and cleanup status. Do not scatter Vision IR, node trees, crops, screenshots, or target IR files across the repo. Keep only user-requested final deliverables after cleanup.
Detail preservation rule: screenshot similarity failures usually come from missing micro-geometry, not missing controllers. Before generating platform code, extract and preserve corner radius, container padding, inter-item spacing, text hierarchy, line count, component height, and internal slot height distribution for every visible card, button, header, input, and repeated cell.
Height preservation rule: never flatten a multi-slot card into a single container height. Any content_card, hero_header, prompt_input, repeated-list cell, rail cell, or fixed CTA must carry both outer height and a slotMetrics / slotLayout contract that explains how media, title, subtitle, badges, metadata, progress, footer, and actions consume vertical space. If the screenshot does not support exact values, preserve measured ratios or min/max constraints with an uncertainty note instead of replacing them with defaults.
Visual fidelity rule: generated code must not be accepted only because the IR validates or the build passes when the selected mode is codegen-with-auto-review. In that mode, create a visual review plan, capture runtime screenshot(s), compare non-material UI regions against the source or cropped source image, and run a bounded patch loop when visual thresholds fail. Non-material view similarity must be at least 0.9 before delivery. If capture is blocked or similarity is below 0.9, do not mark the implementation as deliverable.
Preview Image
-> Artifact Run Manifest
-> Design Source Manifest
-> Source Image Manifest
-> Figma Source Dataset when Figma input exists
-> Reference Image Analysis for screenshot/image inputs
-> Vision IR
-> Node Compression
-> Platform-neutral Semantic UI IR
-> Cross-platform Node Data
-> Platform Conversion Plan
-> Platform Adapter Contract
-> Target Layout IR
-> Target Code
-> Runtime Review / Visual Screenshot Diff / Patch Loop when selected mode is codegen-with-auto-reviewFigma is an optional source adapter, not a separate downstream flow. When Figma MCP node JSON, a Figma screenshot, or both are available, ingest them into the shared source artifacts and continue through the same Semantic UI IR, Cross-platform Node Data, target IR, codegen, and review modes. Hybrid Figma nodes plus screenshot are preferred; either input can also run alone.
For design-decoding-only tasks, stop after the platform-neutral Semantic UI IR. For platform planning tasks, stop after Cross-platform Node Data and Platform Conversion Plan. Enter code generation only when the user asks for a target implementation.
Prefer this skill when both of the following are true:
node-id, Figma MCP node JSON, Figma screenshot/export, annotated design draft, or a request that clearly refers to an external design artifact.Platform should be inferred from both the user request and repo context.
iOS, UIKit, SwiftUI, Android, Compose, View, Web, React, or Next.Representative trigger examples:
解析这图转代码还原页面复刻这个页面走设计稿流程图转节点树生成页面根据这个 Figma 链接实现页面根据设计稿实现页面根据 Figma 还原当前仓库里的页面convert this screenshotimplement this designreview this implementation against the Figmacontinue from this Figma nodeAutomatic MCP trigger rule: when a request contains both a design source signal and design-to-code or design-decoding intent, discover and use the ui_design_to_code MCP before starting local-only implementation work.
For any Figma design flow, first call check_figma_token. If the token is missing, ask the user to input the Figma token directly, then call configure_figma_token to write it into the global Codex config. Do not echo the token. Stop before get_run_modes, create_design_run, or ingest_figma_source until check_figma_token reports configured. Use ui-design-to-code-mcp setup-figma-token only as a fallback when automatic configuration is unavailable.
Do not create a run for existence/configuration checks such as "is this MCP installed", "what version is active", "doctor", or "why did it not trigger" unless the user also provides a design source and asks for decoding, implementation, or review.
If the user did not explicitly specify one of decode-only, plan-only, target-ir, codegen, codegen-with-auto-review, or runtime-review, show the mode-selection prompt before creating artifacts. Use the inferred smallest matching mode only as the recommended/highlighted option:
decode-only for structure analysis, image/Figma decoding, node-tree extraction, or design audit with no platform plan or code request.plan-only for cross-platform feasibility, adapter comparison, or target strategy without target layout/code.target-ir for implementation-ready layout/spec artifacts when the user does not want code changes.codegen for "implement", "generate page", "restore page", "convert to code", or repository UI changes when screenshot parity review is not explicitly required.codegen-with-auto-review when the user asks for 1:1 restoration, screenshot acceptance, parity review after implementation, or browser/simulator/emulator visual verification as part of delivery.runtime-review when an implementation already exists and the user asks only to compare runtime output against the source design.Ask the user to choose a mode whenever the mode is not explicit:
decode-only: parse the image into source manifest, Reference Image Analysis, Vision IR, Node Compression IR, and platform-neutral Semantic UI node tree. No platform plan or code.plan-only: add Cross-platform Node Data and compare target-platform conversion plans. No target layout IR or code.target-ir: generate target-platform layout IR for selected targets. No code.codegen: generate or modify target-platform code, run normal project validation, and cleanup artifacts. Runtime screenshot review is not mandatory in this mode.codegen-with-auto-review: run codegen, then run browser/simulator/emulator screenshot review and visual diff. Non-material UI similarity must be at least 90% before delivery.runtime-review: run an existing target implementation in browser/simulator/emulator, capture screenshots, compare with the source image, and report visual diff. No decoding, IR generation, or code changes unless required inputs are missing.If the mode is target-ir, codegen, codegen-with-auto-review, or runtime-review and the target platform is missing, ask for target platform selection before continuing.
Default artifact location:
<workspace>/generated/ui-design-to-code/<YYYYMMDD-HHMMSS>-<slug>/If the workspace should not be modified, use /private/tmp/ui-design-to-code/<run-id>/. Large temporary crops, screenshots, and debug images should default to /private/tmp.
projectRoot is available, also sync downloaded assets into the target project's default resource locations while keeping the canonical runRoot copies.Artifact Run Manifest.intermediate, debug, review, or final.Design Source Manifest.image, figma, or hybrid input.source_pixel, figma_canvas, logical, and figmaToSourcePixel mapping when both Figma bounds and screenshot pixels are available.Source Image Manifest when an image or Figma screenshot is available.unknown when it cannot be inferred from the image or metadata.Figma Source Dataset when Figma node data is available.projectRoot is provided a target asset sync manifest so later target adapters do not need to re-query Figma or guess resource locations.Reference Image Analysis when an image or screenshot pixel baseline is available.build_reference_analysis to register the artifact.Vision IR.Node Compression IR.primitiveIds, bbox, slotCandidates, grouping evidence, confidence, alternatives, and uncertainties.Platform-neutral Semantic UI IR.confidence on every semantic node.alternatives when confidence is below 0.8.loading, empty, error, content.visualMetrics, contentStructure, and slot-level measurement data for each visible slot.audit_image_decoding after Vision IR, Node Compression IR, and Semantic UI IR are available.Cross-platform Node Data.core, visual, layout, interaction, data, accessibility, and traceability sections.platformHints only as optional hints. They must not replace platform-neutral node data.Platform Conversion Plan.ios-uikit, ios-swiftui, web-react, web-next, android-compose, or android-view.mappingReason for each mapped component.slotMetrics from Semantic UI IR as target slot layout; generated code must consume that data directly.card.height = 404 unless the same component also defines slot heights/ratios that sum to the card layout.codegen.codegen; do not require it unless the user selected codegen-with-auto-review or runtime-review.codegen-with-auto-review.Visual Review Plan with source image/crop, target runtime, viewports, states, thresholds, and output paths.materialExclusions.compare_screenshots.js --min-similarity 0.9 or an adapter-specific equivalent.Visual Review Result with metrics, findings, and blocked status when capture cannot run.0.9; otherwise report blocked/failed status and remaining gaps.runtime-review.capture_web_screenshot.js.run_ios_simulator_review.js.run_android_emulator_review.js.compare_screenshots.js.visual-review-plan.json, runtime screenshot(s), diff output, and visual-review-result.json.Run-mode rule: choose one of decode-only, plan-only, target-ir, codegen, codegen-with-auto-review, or runtime-review before generating artifacts. Do not produce larger downstream artifacts than the user requested.
references/workflow.md: full workflow and acceptance criteria.references/artifact-lifecycle-and-cleanup.md: run directory, retention, cleanup, and disk-size rules.references/artifact-run-manifest.schema.json: run manifest and artifact retention schema.references/design-source-manifest.schema.json: common image/Figma/hybrid source schema.references/figma-source-dataset.schema.json: normalized Figma MCP node dataset schema.references/mcp-and-cross-tool-reuse.md: MCP-first reuse model for Codex, Cursor, and Claude Code.references/workflow-audit-and-optimization.md: known gaps, fixes, and future validator improvements.references/run-modes.md: decode-only, plan-only, target-ir, codegen, codegen-with-auto-review, and runtime-review mode boundaries.references/revision-management.md: patch-loop revision naming and superseded artifact cleanup.references/asset-policy.md: asset naming, dedupe, icon priority, and retention.references/usage-examples.md: examples for each run mode and cleanup.references/visual-implementation-review.md: visual fidelity review, screenshot diff, and patch-loop rules.references/design-image-decoding-workflow.md: platform-neutral image decoding, coordinate systems, artifacts, and self-audit.references/cross-platform-conversion-workflow.md: platform-neutral node data and target adapter conversion flow.references/node-tree-and-mapping.md: node compression and mapping rules.references/cross-platform-node-data.schema.json: adapter-ready platform-neutral node data schema.references/platform-adapter-contract.schema.json: target adapter contract schema.references/platform-conversion-plan.schema.json: cross-platform conversion plan schema.references/target-layout-ios-swiftui.schema.json: SwiftUI target layout IR schema.references/target-layout-web-react.schema.json: React and Next.js target layout IR schema.references/target-layout-android-compose.schema.json: Compose target layout IR schema.references/target-layout-android-view.schema.json: Android View target layout IR schema.references/design-token-map.schema.json: normalized token output and platform token mappings.references/adapter-capability-matrix.schema.json: target adapter support matrix schema.references/asset-policy.schema.json: asset naming, dedupe, and retention schema.references/visual-review-plan.schema.json: source/runtime screenshot review plan schema.references/visual-review-result.schema.json: screenshot comparison result schema.references/platform-adapters/*.json: default adapter contracts for UIKit, SwiftUI, React, Next.js, Compose, and Android View.references/uikit-mapping-contract.json: default semantic-to-UIKit contract.references/image-source-manifest.schema.json: source image metadata and coordinate-space schema.references/reference-analysis.schema.json: pre-decode reference image structure and audit-plan schema.references/vision-ir.schema.json: raw visual primitive schema.references/node-compression-ir.schema.json: grouped-candidate and repeated-template schema.references/platform-neutral-semantic-ui-ir.schema.json: platform-neutral semantic node-tree schema.references/semantic-ui-ir.schema.json: Semantic UI IR schema.references/uikit-layout-ir.schema.json: UIKit Layout IR schema.references/vision-to-semantic-ir.md: prompt template for image-to-semantic IR.references/semantic-ir-to-uikit-ir.md: prompt template for semantic-to-UIKit IR.examples/ai-image-home.semantic.json: example Semantic UI IR.examples/ai-image-home.uikit.json: example UIKit Layout IR.scripts/cleanup_artifacts.js: dependency-free cleanup utility with dry-run default.scripts/validate_pipeline.js: dependency-free cross-artifact pipeline validator.scripts/audit_image_decoding.js: dependency-free image-decoding quality audit for reference analysis, text/media/navigation, and semantic traceability.scripts/capture_web_screenshot.js: Playwright-based web runtime screenshot capture.scripts/run_ios_simulator_review.js: iOS Simulator build/install/launch/screenshot workflow.scripts/run_android_emulator_review.js: Android emulator build/install/launch/screenshot workflow.scripts/compare_screenshots.js: dependency-free screenshot comparison using BMP input or macOS sips conversion.scripts/validate_ir.js: dependency-free local validator.scripts/ui_design_to_code_mcp_server.js: dependency-free MCP stdio server for shared source ingestion, validation, and cleanup.Read only the resource needed for the current step. For code generation tasks, read the selected adapter contract and relevant schemas before writing target code.
Run the cross-artifact validator before accepting any full pipeline output:
node <skill-dir>/scripts/validate_pipeline.js \
--run path/to/runFor image decoding runs, also run the decoding audit after Vision IR, Node Compression IR, and Semantic UI IR exist:
node <skill-dir>/scripts/audit_image_decoding.js \
--run path/to/runRun the bundled legacy validator before generating or accepting UIKit code:
node <skill-dir>/scripts/validate_ir.js \
--semantic path/to/page.semantic.json \
--uikit path/to/page.uikit.json \
--contract <skill-dir>/references/uikit-mapping-contract.jsonIf no paths are provided, the script validates the bundled examples.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.