annotations-figma — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited annotations-figma (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Annotations are designer-authored specs attached to a node. Each can carry a note (plain label or rich labelMarkdown), a set of pinned properties (fills, width, fontSize, …) that link the note to specific design attributes, and an optional category (interactions, accessibility, dev notes, …). They live on the node, survive edits, and are undoable (Cmd+Z). They are the right place for animation timings, easing curves, interaction behavior, and a11y requirements that don't belong in the component description.
await + return (no IIFE, no figma.closePlugin(); console.log is not returned), inputs inlined as const at the top of each script, colors in 0–1 range, load fonts before any text op, await figma.getNodeByIdAsync(...), and atomic errors (a failed script applies nothing — read the error, fix, retry).apply to nodes whose type supports them (frames, components, instances, shapes, text — not pages).
can pass a real categoryId (category names are per-file and not guessable). See the script.
scripts/get-annotations.js — set INCLUDE_CHILDRENto walk a component tree for full-component documentation.
scripts/set-annotations.js. Choose MODE:'replace' (default — overwrites all annotations on the node) or 'append' (keeps existing). Pass ANNOTATIONS = [] with 'replace' to clear all annotations.
if a workflow also writes text nodes, await figma.loadFontAsync(...) first (see conventions).
label and labelMarkdown on read, but rejects writing both — whenappending, prefer labelMarkdown if present, else label. The append script already does this.
properties only pins which attributes the note is about; it does not set their values. Use theexact strings from references/annotation-properties.md.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.