figma-mcp-express-71f421 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited figma-mcp-express-71f421 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
! tmpdir="${TMPDIR:-${TEMP:-${TMP:-/tmp}}}"; tmpdir="${tmpdir%/}"; sid="${CLAUDE_CODE_SESSION_ID:-${CLAUDE_SESSION_ID:-${CODEX_SESSION_ID:-}}}"; sid="$(printf "%s" "$sid" | tr -cd 'A-Za-z0-9_-')"; touch "${tmpdir}/fme-skill-loaded-${sid:-default}" 2>/dev/null || true; touch "${tmpdir}/fme-skill-loaded-default" 2>/dev/null || true
Use the compact core tool surface first. Full plugin capability lives behind validated batch ops; legacy top-level tools appear only with FIGMA_MCP_TOOL_PROFILE=full.
get_metadata; if multiple files are open, call list_channels.channel is mandatory: pass it on every file-specific tool. For batch, put channel only on the outer call.get_variable_defs means no local variables, not no design system. Check subscribed libraries with list_library_variable_collections.search_batch_ops -> get_batch_op_spec -> batch(validateOnly:true) -> batch.BatchOpCatalog; do not copy op schemas into skill docs.use_figma scripts, eval, or code strings. Use declarative batch ops only.get_design_context detail:"minimal" depth:1, then scan_text_nodes or get_node depth:2-3.save_screenshots only as the final visual pass.continueOnError:true for scanned lists.| Need | Read |
|---|---|
| Read-tool choice, detail levels, style audit, common errors | references/tool-selection.md |
Batch refs, projection, map, validation-first recipes, write-workflow recipes | references/batch-recipes.md |
| Workflow recipes: rename, text replacement, annotations, overrides | references/workflow-recipes.md |
| Prototype wiring/audit/reaction maps/scroll-fixed chrome | Load companion skill figma-prototype; keep MCP execution discipline here |
Native effects (GLASS/NOISE/TEXTURE), set_effects, create_effect_style | references/effects.md |
| Permanent Figma Plugin API constraints (instance children, clone IDs, auto-layout children, etc.) | references/platform-constraints.md |
| Server bugs + workarounds with issue tracking (#33, #34) | references/mcp-known-bugs.md |
| Remaining failure modes: stale IDs, node format, spilled cache, text/font/image | references/gotchas.md |
| Parallel agents, channel partitioning, shared-resource handoff | references/multi-agent.md |
Watch-agent presence (origin, set_presence, status/task, per-session no-clobber) | references/presence.md |
| Parameterized generators (type scale, color palette, component variants, design tokens) | MCP prompts: generate_type_scale, generate_color_palette, generate_component_variants, design_token_generation_strategy — invoke via the MCP prompts list |
fetch_library_catalog with FIGMA_TOKEN.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.