component-properties-figma — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited component-properties-figma (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Two related jobs:
TEXT, BOOLEAN, INSTANCE_SWAP, andVARIANT properties so the component exposes the right knobs (the Figma equivalent of a React component's props).
variant selection, swapped sub-instances).
await + return (no IIFE, no figma.closePlugin(); console.log is not returned), inputs inlined as const at the top of each script, colors in 0–1 range, load fonts before any text op, await figma.getNodeByIdAsync(...), and atomic errors (a failed script applies nothing — read the error, fix, retry).use analyze-component-set-figma or deep-component-figma.
get_design_context /get_metadata (read-only) do not cover.
| Type | What it controls | defaultValue | Notes |
|---|---|---|---|
TEXT | A text-layer string override | "Label" | Bind in UI to a text node's characters |
BOOLEAN | Show/hide a layer | true/false | Bind to a layer's visibility |
INSTANCE_SWAP | Which sub-component fills a slot | a component key | Pass preferredValues to populate the picker |
VARIANT | A variant axis (Size, State…) | one option string | Only meaningful on a COMPONENT_SET |
individual variant — the script errors and tells you to use the parent set.
scripts/add-property.js (use_figma,skillNames: "component-properties-figma"). Set NODE_ID, PROPERTY_NAME, PROPERTY_TYPE, DEFAULT_VALUE. addComponentProperty returns a name with a #id suffix — capture it.
editComponentProperty(name, {...}) /deleteComponentProperty(name) calls (commented variants are in the script). Use the suffixed name returned at creation for edits/deletes of non-variant props.
node.componentPropertyDefinitions (the script returns it).componentKey (preferred) and/or a localnodeId. Pass both when you have them — the script tries the library import first, then the local node.
scripts/instantiate-and-set.js. Set COMPONENT_KEY /COMPONENT_ID, optional VARIANT (e.g. { Size: "md", State: "default" }), OVERRIDES, POSITION, and PARENT_ID.
setProperties path — it loadsthe main component, then matches plain names and Name#id-suffixed names automatically.
("Label#12:3"); VARIANT props use the bare name. The instantiate script resolves both, so you can pass the human name (Label) and it finds the suffixed key.
setProperties / instance properties, never set .characters on a nested instance text node.
componentKey only works for published components. For local/unpublished ones use nodeId.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.