flato-design-mcp-guide-0dee00 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited flato-design-mcp-guide-0dee00 (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill whenever the user wants an AI agent to operate a Flato design through MCP.
Flato is an editable visual design canvas. The MCP server gives agents tools, resources, prompts, project targeting, image capabilities, and feedback. It is not a hidden one-shot design agent. The agent must read current Flato context explicitly and then call concrete MCP tools.
A Flato account is required for OAuth. A paid Flato subscription is not required to install, connect, or start using Flato Design MCP.
Do not tell users they must subscribe before connecting. If an MCP response says a feature is limited by plan, usage, export, workspace, or credits, report that specific limitation and suggest the next available path.
Before any design write:
flato://canvas/fundamentals-v1, or callflato_get_canvas_fundamentals as a fallback.
flato_whoami.flato_create_project.flato_use_project.flato_use_share_link to create an editable copy.editorUrl when thehost supports URL opening. Otherwise ask the user to open it.
flato_get_project_status until canWrite=true.flato_get_design_context before each create or edit sequence.Do not call write tools until canWrite=true.
projectId for saved projects.clientId only when targeting a specific live editor tab.draftId for an unsaved /editor canvas.pageId or blockId.flato_get_design_context or flato_get_state.selection-dependent edit.
flato_create_pages.flato_update_pages.updateBlocks[].blockId for existing blocks and createBlocks for newblocks.
with flato_update_canvas.
flato_set_global_style. CSS must be scopedunder .Canvas.
flato_delete_block.flato_page_operation.flato_make_backup before risky broad edits.Do not rely only on tool descriptions for design work. MCP resources and prompts are part of the operating contract.
Expected resources include:
flato://canvas/fundamentals-v1flato://prompt-skillsflato://prompt-skills/general-design-defaultflato://prompt-skills/presentation-coverflato://prompt-skills/social-visualflato://prompt-skills/brand-systemflato://brand-kitsRead brand-kit resources when the user asks for branded, marketing, sales, presentation, or customer-facing output.
Page-level interactions are authored through interactiveScript on flato_create_pages and flato_update_pages.
Rely on current MCP tool schemas and flato://canvas/fundamentals-v1 for the full interaction contract. Do not duplicate or guess unsupported schema fields.
Supported inline events include click/input/change and desktop hover/mouse events such as onclick, onchange, oninput, onmouseover, onmouseout, onmouseenter, and onmouseleave.
Hover is supported for desktop experiences. Include click/tap behavior or a visible fallback when mobile touch users matter.
Asset tools such as image search, generation, editing, and understanding do not mutate the design unless a specific write tool places the returned URL into a page or block.
Do not claim an image is in the design until it has been explicitly written into the canvas.
Paid image generation or editing may consume the authenticated Flato user's credits.
After a write:
mcpFeedback when present.flato_get_design_context.layoutIssueSummary as the compact layout QA signal.flato_export with PNG or JPG preview quality andthen flato_understand_image for visual QA.
Use flato_export to export a page, all pages, or a block from a connected Flato browser editor. Supported formats are PNG, JPG, PDF, and image-only PPTX where applicable. PPTX supports page or all-pages exports, not block exports.
For visual QA, prefer PNG or JPG with preview quality and pass the returned image URL to flato_understand_image.
When done, report:
projectIdmcpFeedback.status when availablelayoutIssueSummary~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.