Figma Implement DesignSAFE
The secure, validated skill registry for professional AI coding agents. Extend Antigravity, Claude Code, Cursor, Copilot and more with absolute confidence.
Overview
The secure, validated skill registry for professional AI coding agents. Extend Antigravity, Claude Code, Cursor, Copilot and more with absolute confidence.
069343ba7895OBSERVED · 2026-10-07What it tells the agent
The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.
--- name: figma-implement-design description: Translate Figma nodes into production-ready code with 1:1 visual fidelity using the Figma MCP workflow (design context, screenshots, assets, and project-convention translation). Use when the user provides Figma URLs or node IDs and asks to implement designs or components that must match Figma specs. Requires a working Figma MCP server connection. Do NOT use for general Figma data fetching, variable exploration, or MCP troubleshooting (use figma instead). metadata: author: github.com/openai/skills version: '1.0.0' --- # Implement Design ## Overview This skill provides a structured workflow for translating Figma designs into production-ready code with pixel-perfect accuracy. It ensures consistent integration with the Figma MCP server, proper use of design tokens, and 1:1 visual parity with designs. ## Prerequisites - Figma MCP server must be connected and accessible - User must provide a Figma URL in the format: `https://figma.com/design/:fileKey/:fileName?node-id=1-2` - `:fileKey` is the file key - `1-2` is the node ID (the specific component or frame to implement) - **OR** when using `figma-desktop` MCP: User can select a node directly in the Figma desktop app (no URL required) - Project should have an established design system or component library (preferred) ## Required Workflow **Follow these steps in order. Do not skip steps.** ### Step 0: Set up Figma MCP (if not already configured) If any MCP call fails because Figma MCP is not connected, pause and set it up: 1. Add the Figma MCP server to your agent's MCP configuration: - URL: `https://mcp.figma.com/mcp` 2. Enable remote MCP client if required by your agent. 3. Log in with OAuth following your agent's authentication flow. After successful login, the user will have to restart their agent. You should finish your answer and tell them so when they try again they can continue with Step 1. ### Step 1: Get Node ID #### Option A: Parse from Figma URL When the user provides a Figma URL, extract the file key and node ID to pass as arguments to MCP tools. **URL format:** `https://figma.com/design/:fileKey/:fileName?node-id=1-2` **Extract:** - **File key:** `:fileKey` (the segment after `/design/`) - **Node ID:** `1-2` (the value of the `node-id` query parameter) **Note:** When using the local desktop MCP (`figma-desktop`), `fileKey` is not passed as a parameter to tool calls. The server automatically uses the currently open file, so only `nodeId` is needed. **Example:** - URL: `https://figma.com/design/kL9xQn2VwM8pYrTb4ZcHjF/DesignSystem?node-id=42-15` - File key: `kL9xQn2VwM8pYrTb4ZcHjF` - Node ID: `42-15` #### Option B: Use Current Selection from Figma Desktop App (figma-desktop MCP only) When using the `figma-desktop` MCP and the user has NOT provided a URL, the tools automatically use the currently selected node from the open Figma file in the desktop app. **Note:** Selection-based prompting only works with the `figma-desktop` MCP server. The remote server requires a link to a frame or layer to extract context. The user must have the Figma desktop app open with a node selected. ### Step 2: Fetch Design Context Run `get_design_context` with the extracted file key and node ID. ``` get_design_context(fileKey=":fileKey", nodeId="1-2") ``` This provides the structured data including: - Layout properties (Auto Layout, constraints, sizing) - Typography specifications - Color values and design tokens - Component structure and variants - Spacing and padding values **If the response is too large or truncated:** 1. Run `get_metadata(fileKey=":fileKey", nodeId="1-2")` to get the high-level node map 2. Identify the specific child nodes needed from the metadata 3. Fetch individual child nodes with `get_design_context(fileKey=":fileKey", nodeId=":childNodeId")` ### Step 3: Capture Visual Reference Run `get_screenshot` with the same file key and node ID for a visual reference. ``` get_screenshot(fileKey=":fileKey", nodeId="1-2") ``` This screenshot serves as the source of truth for visual validation. Keep it accessible throughout implementation. ### Step 4: Download Required Assets Download any assets (images, icons, SVGs) returned by the Figma MCP server. **IMPORTANT:** Follow these asset rules: - If the Figma MCP server returns a `localhost` source for an image or SVG, use that source directly - DO NOT import or add new icon packages - all assets should come from the Figma payload - DO NOT use or create placeholders if a `localhost` source is provided - Assets are served through the Figma MCP server's built-in assets endpoint ### Step 5: Translate to Project Conventions Translate the Figma output into this project's framework, styles, and conventions. **Key principles:** - Treat the Figma MCP output (typically React + Tailwind) as a representation of design and behavior, not as final code style - Replace Tailwind utility classes with the project's preferred utilities or design system tokens - Reuse existing components (buttons, inputs, typography, icon wrappers) instead of duplicating functionality - Use the project's color system, typography scale, and spacing tokens consistently - Respect existing routing, state management, and data-fetch patterns ### Step 6: Achieve 1:1 Visual Parity Strive for pixel-perfect visual parity with the Figma design. **Guidelines:** - Prioritize Figma fidelity to match designs exactly - Avoid hardcoded values - use design tokens from Figma where available - When conflicts arise between design system tokens and Figma specs, prefer design system tokens but adjust spacing or sizes minimally to match visuals - Follow WCAG requirements for accessibility - Add component documentation as needed ### Step 7: Validate Against Figma Before marking complete, validate the final UI against the Figma screenshot. **Validation checklist:** - [ ] Layout matches (spacing, alignment, sizing) - [ ] Typography matches (font, size, weight
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | NA |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (1)
CLAUDE.md
Gates applied: no_behavioural_pass.
069343ba7895full audit observations/trust-audit/skill/tech-leads-club__figma-implement-design.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | 069343ba7895 | SAFE | B | 89 | first audit |
Questions
What does the Figma Implement Design skill do?
The secure, validated skill registry for professional AI coding agents. Extend Antigravity, Claude Code, Cursor, Copilot and more with absolute confidence.
Is Figma Implement Design safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can Figma Implement Design access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
How current is this page?
The grade is for one exact copy of the source (069343ba7895), read on 2026-10-07. The repository is watched, and a new audit runs when it changes — this is the first audit.