figma-to-code
Map Figma variables to repo tokens and write Figma agent rules. Use when asked to "extract Figma design tokens", "map Figma tokens to our theme", "create Figma design system rules", "set up Figma guidelines", "code connect this component", or "map this Figma component to code"; when Figma-to-code output must follow this repository's components, tokens, and rules files (`AGENTS.md`, `CLAUDE.md`, `.cursor/rules/`) or needs a correction pass against them; or when asked to "implement this Figma design" or "build from a Figma link" and `figma-design-to-code` is not installed. Skip Figma-side writes and code-to-Figma CI export (use `code-to-figma`).
93%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Low
Low-risk findings worth noting
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The required workflow ingests outsider-authored design data and generated code via Figma MCP tools (such as `get_design_context`), which are treated as untrusted and can contain prompt injection risks.
- Repository
t4sh/skills4sh
- Revision
2411395
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.