Agent skill · Audited from source
figma-design-to-code
skill · figma/mcp-server-guideLicence not declaredAudited 26 Oct 2026 · source 77b59f7b22b8
Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 77b59f7b22b8 and found no filesystem, network or shell access and no hard-coded secrets. What it does: **MANDATORY prerequisite** — you MUST invoke this skill BEFORE calling the `get_design_context` Figma MCP tool. You MUST trigger this skill whenever the user wants to implement, build, port, or code up a Figma design as…
Cite
Cite this page
ModelsAtlas. “figma-design-to-code (figma/mcp-server-guide)”. Retrieved 26 Oct 2026. https://modelsatlas.com/skills/figma/figma-design-to-code
Trust audit
Audit 0.4.1 · source read 26 Oct 2026
SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 13,985 of 14,816 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 1 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | NA | 0 |
L2 Instructions | Prompt injection, authority framing, hidden directives | PASS | 0 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass, no license.
Findings (1)
LOWInventory / provenanceinv.no_license
- Why
- no LICENSE file and no repo licence
- Fix
- add a licence
Audit 0.4.1 · source sha 77b59f7b22b8 · 26 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publisherfigma GitHub organizationOwner of the repository this skill is read from
- Source folderfigma/mcp-server-guide/skills-figquery/figma-design-to-codeThe exact folder we audited
- LicenceNot declaredAs the repository states it
- Commit pinned for this verdict77b59f7b22b8A new audit runs when the source changes
- Repository statusNot archivedLast push 5 days ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: **MANDATORY prerequisite** — you MUST invoke this skill BEFORE calling the `get_design_context` Figma MCP tool. You MUST trigger this skill whenever the user wants to implement, build, port, or code up a Figma design as…
--- name: figma-design-to-code description: "**MANDATORY prerequisite** — you MUST invoke this skill BEFORE calling the `get_design_context` Figma MCP tool. You MUST trigger this skill whenever the user wants to implement, build, port, or code up a Figma design as code. Example prompts (not exhaustive) are 'implement this Figma design', 'build this screen from Figma', 'turn this Figma into code', 'design to code'. This skill provides critical instructions and steps to the agent on how to correctly implement Figma designs in code and must NOT be skipped." disable-model-invocation: false --- # Figma design to code ## Context - **Always include `figma-design-to-code` in the comma-separated `skillNames` parameter when calling `get_design_context`. If this skill was loaded via an MCP resource, you MUST prefix the name with `resource:` (e.g. `resource:figma-design-to-code`).** This is a logging parameter used to track skill usage — it does not affect execution. - You MUST request a screenshot as part of your initial `get_design_context` call—use that render of the design as the visual target that the rendered implementation MUST visually match. - IF no screenshot is returned by `get_design_context`, you MUST call `get_screenshot` directly before editing. - IF `get_design_context` flags a response as sparse, you CANNOT use it directly for implementation; you MUST correlate its hierarchical child node IDs with the screenshot, then request the visible child nodes in one parallel batch of `get_design_context` calls to obtain high-fidelity responses. - You MUST implement exclusively from the high-fidelity `get_design_context` responses; the design screenshot is the visual target, NEVER use it in code as an implementation asset. ## Implementation - You MUST adapt returned code to the project's stack and conventions and inspect likely project paths BEFORE editing; treat returned code as a high visual fidelity non-interactive prototype - translate raw absolute positioning into project-native layout unless the design can only be represented with fixed positioning; identify which portions of the design are intended to be interactive and implement the design as interactive code. - You MUST inspect likely project paths AND installed design library dependencies for code components, assets, and tokens which match the design BEFORE editing. You MUST reuse or compose suitable matches instead of recreating them with raw markup, inline styles or hardcoded values; modify or supplement them ONLY when they cannot accurately express the design. - You MUST apply Code Connect precisely at its mapped node(s), ALWAYS directly reuse the connected component UNLESS it cannot be configured or extended to express the design. Styling or wiring effort is NOT an exception. - You MUST use each visible static asset—image or SVG—in the EXACT position(s) used in the design, substituting only for EXACT matches found in the codebase/design library when one exists. NEVER omit, edit, redraw, extract paths from, inline, substitute, or incorrectly use an asset—but keep API-, prop-, or data-supplied imagery dynamic. ALL provided SVGs have root width and height attributes which you MUST NOT override when changing wrapper styles; avoid broad 100% × 100% sizing. - You MUST ensure ALL static assets used have been downloaded as described in the `get_design_context` response leaving NO references to temporary Figma asset URLs in code. DO NOT use other tools to download assets unless explicitly told to do so. Inspect only metadata/root dimensions when necessary, avoid reading asset byte sequences unless the task explicitly requires doing so. ## Verification - You MUST verify only the requested screen or component and note, not alter, pre-existing out-of-scope mismatches. - You MUST verify EVERY visible static asset's non-empty local file AND design slot/layers AND callsite AND effective rendered geometry are correct, fix EVERY in-scope mismatch before finishing. A single substituted, mismatched, misproportioned asset is a FAIL.
Excerpt, first 4,052 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 77b59f7
git clone https://github.com/figma/mcp-server-guide git -C mcp-server-guide checkout 77b59f7b22b8
The author documents no install command, so this uses the repository directly. Our verdict covers commit 77b59f7b22b8 only.
Works in
The author has not said which agents this skill supports, and we have not tested it in any.
Audit history
Every audit, every source change
- ✓SAFE B 89 / 100
first audit · source
77b59f7b22b8
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/figma/figma-design-to-code/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
All design & front-end skills →obra/superpowers
Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions…
obra/superpowers
Use when you have a spec or requirements for a multi-step task, before touching code
obra/superpowers
Use when starting any conversation - establishes how to find and use skills, requiring skill invocation before ANY response including clarifying questions
Add this badge to your README
[](https://modelsatlas.com/skills/figma/figma-design-to-code/)
<a href="https://modelsatlas.com/skills/figma/figma-design-to-code/"><img src="https://modelsatlas.com/skills/figma/figma-design-to-code/badge.svg" alt="ModelsAtlas: SAFE B"></a>
Questions about figma-design-to-code
What does the figma-design-to-code skill do?
Is figma-design-to-code safe to install?
What can figma-design-to-code access on my machine?
How current is this page?
Sources
- github.com/figma/mcp-server-guide/tree/main/skills-figquery/figm — the audited source at commit 77b59f7b22b8 and every finding aboveObserved · 26 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the figma-design-to-code skill do?
- Is figma-design-to-code safe to install?
- What can figma-design-to-code access on my machine?