deep-component-figma — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited deep-component-figma (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Walk one node (usually a COMPONENT / COMPONENT_SET / INSTANCE, but any node works) recursively to a depth you choose, capturing at every level: layout (auto-layout, padding, spacing, sizing), visual properties (fills, strokes, stroke weight, corner radius, effects, opacity), typography for text nodes, boundVariables resolved to token names + code syntax, INSTANCE main-component references (including whether the main is a variant and its set), prototype reactions, and dev-mode annotations. This is the richest single-component read for high-fidelity code generation.
await + return (no IIFE, no figma.closePlugin(); console.log is not returned), inputs inlined as const at the top of each script, colors in 0–1 range, load fonts before any text op, await figma.getNodeByIdAsync(...), and atomic errors (a failed script applies nothing — read the error, fix, retry).design-system-inventory-figma.use analyze-component-set-figma.
get_design_context (rendered single-selection summary) or get_metadata (flat structure) return — it is a design-system code-gen capability layered on top.
figma_get_selection), search, or a pasted id.const DEPTH (default 10). Deep design components rarely exceed ~6levels; use a smaller number first to keep the payload manageable, then go deeper if needed.
scripts/deep-component.js via use_figma(skillNames: "deep-component-figma"). Set const NODE_ID and const DEPTH at the top.
boundVariablestoken names (and their codeSyntax) over raw hex; use mainComponent refs to reuse imported components; use reactions to wire up interaction/navigation.
DEPTH (nodes past the limit are summarized with achildCount + _depthLimitReached marker) or target a smaller sub-node id.
id, name, type, visible. Hidden non-component nodes are marked _hidden andnot recursed.
layoutMode, axis sizing/align, padding*, itemSpacing, counterAxisSpacing,layoutWrap, min/max width/height, clipsContent.
fills, strokes, strokeWeight, cornerRadius, effects, opacity(only when non-default; figma.mixed values are skipped safely).
characters, fontSize, fontFamily/fontStyle, fontWeight,lineHeight, letterSpacing, alignment, truncation, case, decoration.
boundVariables resolved to { id, name, collection, resolvedType, codeSyntax } perbound property.
mainComponent (id, name, key, isVariant, set name/id) + componentProperties.componentPropertyDefinitions, variantProperties.reactions (trigger + action: navigation/transition/destination).annotations (label markdown + categorized properties).non-Enterprise files get token names instead of opaque VariableID: aliases.
_variableMapSize and _maxDepthUsed for sanity-checking.affectedNodeIds: [NODE_ID] even though this is a read — keeps the convention uniform.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.