setup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited setup (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run each of the following checks and report a summary table at the end.
If the user provided arguments (e.g. /setup FIGMA_API_KEY=fig_xxx), parse them first:
export FIGMA_API_KEY=<value> in the current shellFIGMA_API_KEY is already in ~/.zshrc (or ~/.bashrc):export FIGMA_API_KEY=<value>If no arguments are provided, proceed normally and prompt for missing required values at the end.
Check whether each variable is set (non-empty) in the current shell environment:
| Variable | Required | Used by |
|---|---|---|
FIGMA_API_KEY | Yes | figma, figma-console MCP servers |
For each variable, report ✅ Set or ❌ Missing.
If any required variable is missing, show the setup command for the user's OS:
export FIGMA_API_KEY=fig_xxxxxxxxxxxxxxxxxxxxx (add to ~/.zshrc or ~/.bashrc)Check if typescript-language-server is available on $PATH by running:
which typescript-language-serverReport ✅ Installed or ❌ Missing. If missing, show:
npm install -g typescript-language-server typescriptCheck if the figma-console-mcp package is installed globally:
npm list -g figma-console-mcp 2>/dev/nullIf not installed, install it:
npm install -g figma-console-mcpReport ✅ Installed or ⚠️ Missing (and auto-install if missing).
Read .mcp.json at the project root and verify each server:
| Server | Type | Check |
|---|---|---|
| context7 | npx | npx -y @upstash/context7-mcp --help resolves |
| playwright | npx | npx -y @playwright/mcp --help resolves |
| figma | npx + env | Package resolves AND $FIGMA_API_KEY is set |
| figma-console | npx + env | Package resolves AND $FIGMA_API_KEY is set |
| sequential-thinking | npx | npx -y @anthropic/sequential-thinking-mcp --help resolves |
| miro-mcp | URL (SSE) | URL https://mcp.miro.com/sse is configured |
| shadcn | npx | npx -y shadcn@latest mcp --help resolves |
For servers marked as needing env vars, cross-reference with section 1 results.
If any server is missing from .mcp.json, offer to add it.
Report each server as ✅ Configured or ⚠️ Needs attention.
Print a single summary table:
┌───────────────────────────┬────────┐
│ Check │ Status │
├───────────────────────────┼────────┤
│ FIGMA_API_KEY │ ✅/❌ │
│ TypeScript LSP │ ✅/❌ │
│ figma-console-mcp (npm) │ ✅/⚠️ │
│ context7 MCP │ ✅/⚠️ │
│ playwright MCP │ ✅/⚠️ │
│ figma MCP │ ✅/⚠️ │
│ figma-console MCP │ ✅/⚠️ │
│ sequential-thinking MCP │ ✅/⚠️ │
│ miro-mcp MCP │ ✅/⚠️ │
│ shadcn MCP │ ✅/⚠️ │
└───────────────────────────┴────────┘If any checks failed, offer to fix them automatically:
npm install -g typescript-language-server typescriptnpm install -g figma-console-mcp/setup again after fixing network/npm issuesOnly proceed with auto-fixes if the user confirms.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.