export-tokens-figma — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited export-tokens-figma (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Read every local variable in a Figma file and emit design-token files. The canonical output is DTCG (W3C Design Tokens Community Group JSON); CSS, Tailwind, SCSS, TS, and JSON derive from it.
Why this beats a raw REST export: Figma's Variables REST API is Enterprise-only (403 on Starter/Pro/Org). This skill reads through the Plugin API via use_figma, so it works on every plan and resolves aliases + multi-mode values that get_variable_defs (default mode only) drops.
await + return (no IIFE, no figma.closePlugin(); console.log is not returned), inputs inlined as const at the top of each script, colors in 0–1 range, load fonts before any text op, await figma.getNodeByIdAsync(...), and atomic errors (a failed script applies nothing — read the error, fix, retry).import-tokens-figma skill.dtcg is the safe default), whetherto split by mode/collection, and the output path. Get the file key from the active Figma file or a URL the user provides.
scripts/read-variables.js via use_figma(skillNames: "export-tokens-figma"). It returns the normalized collections/modes/variables tree with hex colors, resolved alias references, scopes, and code syntax.
variables.json.hand-write the conversion** — this script is the source of truth and produces identical output every run:
node scripts/convert-tokens.mjs variables.json --format dtcg --out tokens/
# --format: dtcg (default) | css-vars | tailwind-v4 | tailwind-v3 | scss | ts-module
# | json-flat | json-nested | style-dictionary-v3 | tokens-studio
# (aliases: css, tailwind, ts)
# --out <dir> write file(s) — tokens-studio writes several; omit to print to stdout
# --prefix <p> prefix CSS/SCSS var names
# --modes Light,Dark include only these modes (default: all)
# --collection <substr> include only collections whose name contains <substr>This matches the Console figma_export_tokens formatters. It handles exactly what freehand conversion gets wrong: per-type units (opacity/line-height unitless, spacing/radius px); multi-mode output (CSS & Tailwind v4 emit :root + .dark/[data-theme]; TS/JSON emit {mode: value}; SCSS suffixes modes; DTCG keeps them in $extensions); aliases → `var()`/`{ref}`; font-weight names → numbers; DTCG round-trip metadata; and it warns on slug collisions and non-numeric weights. (style-dictionary-v3 and tailwind-v3 use the primary mode, matching the Console — those formats have no native multi-mode encoding.)
weight issues are real findings about the Figma file, worth flagging to the user).
documents the formats it emits; it is reference, not a thing to re-implement by hand.
read-variables.js runs anywhere via use_figma. convert-tokens.mjs is Node,so it needs a terminal-capable agent (Claude Code, the Code tab in Claude Desktop, Cursor, Codex, Gemini CLI). In plain Desktop/web chat (no shell), run the converter on your own machine against the saved variables.json, or accept a best-effort inline conversion for DTCG only.
var(--…) / {ref} — export all collections together sothose references resolve.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.