analyze-component-set-figma — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited analyze-component-set-figma (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Take a Figma COMPONENT_SET (the purple dashed container holding all the variants of one component) and turn it into a code-generation blueprint: which property axes are state vs size, how each state maps to a CSS pseudo-class or ARIA attribute, and the minimal visual delta each state applies on top of the default variant. This is the bridge between "Figma has 12 button variants" and "emit one .btn rule + :hover/:disabled overrides."
await + return (no IIFE, no figma.closePlugin(); console.log is not returned), inputs inlined as const at the top of each script, colors in 0–1 range, load fonts before any text op, await figma.getNodeByIdAsync(...), and atomic errors (a failed script applies nothing — read the error, fix, retry).deep-component-figma.arrange-component-set-figma.component-properties-figma.get_design_context /get_metadata do not provide — they return raw structure, not a variant→CSS state machine.
figma_get_selection), a search, or anode id they paste. It must be the set, not an individual variant — the script validates type.
scripts/analyze-component-set.js via use_figma(skillNames: "analyze-component-set-figma"). Set const COMPONENT_SET_ID at the top first.
variantAxes (each axis + its options), componentProps(non-variant TEXT/BOOLEAN/INSTANCE_SWAP props → code props), a stateMachine with cssMapping (state name → CSS selector) and defaultSignature, and per-variant diffFromDefault.
defaultSignature, then add one rule percssMapping entry applying only that variant's diffFromDefault. Map componentProps to framework props: BOOLEAN→boolean, TEXT→string, INSTANCE_SWAP→ReactNode/slot, VARIANT→union.
stateMachine.states got a CSS rule, and thattoken names in the diff (e.g. Color/Brand/Primary) resolve to your exported tokens.
The script normalizes the state axis value (case-insensitive) to a selector:
| Variant value | CSS / ARIA selector | |
|---|---|---|
default | (base rule, no selector) | |
hover | :hover | |
focus / focused / focus-visible | :focus-visible | |
active / pressed | :active | |
disabled | :disabled, [aria-disabled="true"] | |
error / invalid | [aria-invalid="true"] | |
selected | [aria-selected="true"] | |
checked | :checked | |
loading | [aria-busy="true"] | |
open / closed | `[aria-expanded="true" | "false"]` |
filled | .has-value |
diffFromDefault lists only theproperties that change (fill token, stroke, text color, opacity, effects, child visibility). Emit exactly those as overrides — don't re-specify unchanged properties.
boundVariables (fills/strokes) to token names when available, fallingback to raw hex. Prefer the token name in generated code.
state/status/interaction is the state axis;size/scale is the size axis. If your set names axes differently, the cssMapping may be empty — read variantAxes and map states yourself.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.