Is figma-use safe?
Grade A, 92/100. No meaningful risk found.
**MANDATORY prerequisite** — you MUST invoke this skill BEFORE every `use_figma` tool call. NEVER call `use_figma` directly without loading this skill first. Skipping it causes common, hard-to-debug failures. Trigger whenever the user wants to perform a write action or a unique read action that requires JavaScript execution in the Figma file context — e.g. create/edit/delete nodes, set up variables or tokens, build components and variants, modify auto-layout or fills, bind variables to properties, or inspect file structure programmatically.
Afigma-use
skills/.curated/figma-use92/100 · No meaningful risk found2 medium
figma-use
skills/.curated/figma-use**MANDATORY prerequisite** — you MUST invoke this skill BEFORE every `use_figma` tool call. NEVER call `use_figma` directly without loading this skill first. Skipping it causes common, hard-to-debug failures. Trigger whenever the user wants to perform a write action or a unique read action that requires JavaScript execution in the Figma file context — e.g. create/edit/delete nodes, set up variables or tokens, build components and variants, modify auto-layout or fills, bind variables to properties, or inspect file structure programmatically.
- Content hash
- sha256:1a93e4ce5fbab22060b81f458d515fb4bb993a45400f7aa4884f0d84b1a0bd6b
- Files
- 29
- Quality
- 100/100
Security findings
- mediumZero-width charactersSL112 · skills/.curated/figma-use/references/plugin-api-standalone.d.ts:8497
* Caution: ⚠ Did you know: not all glyphs that you might think as a "character" are actually stored as a single character in JavaScript string? JavaScript stri…3 zero-width characters found. They are invisible and can split keywords to dodge review. Fix: Remove the zero-width characters.
- mediumZero-width charactersSL112 · skills/.curated/figma-use/references/plugin-api-standalone.d.ts:8507
* Caution: ⚠ Did you know: not all glyphs that you might think as a "character" are actually stored as a single character in JavaScript string? JavaScript stri…3 zero-width characters found. They are invisible and can split keywords to dodge review. Fix: Remove the zero-width characters.
- infoRole reassignmentSL103 · skills/.curated/figma-use/references/working-with-design-systems/wwds.md:41
For example, how you reflect the "hover" state of a button could be left entirely up to you to make a reasonable decision for a user that is playing around wit…The skill tries to reassign the agent's identity or unlock a 'mode'. Fix: Describe the task instead of redefining who the agent is. Severity lowered: the line reads as documentation, not an instruction.
Files in this skill
- LICENSE.TXT440 B
- SKILL.md17.4 KB
- maintainers.yml21 B
- agents/openai.yaml452 B
- assets/figma-small.svg818 B
- assets/figma.png1.6 KB
- assets/icon.svg964 B
- references/api-reference.md10.9 KB
- references/common-patterns.md15.7 KB
- references/component-patterns.md18.1 KB
- references/effect-style-patterns.md3.0 KB
- references/gotchas.md23.0 KB
- references/maintainers.yml418 B
- references/plugin-api-patterns.md12.1 KB
- references/plugin-api-standalone.d.ts440.2 KB
- references/plugin-api-standalone.index.md27.9 KB
- references/text-style-patterns.md6.4 KB
- references/validation-and-recovery.md5.6 KB
- references/variable-patterns.md12.0 KB
- references/working-with-design-systems/maintainers.yml303 B
- references/working-with-design-systems/wwds-components--creating.md2.1 KB
- references/working-with-design-systems/wwds-components--using.md2.0 KB
- references/working-with-design-systems/wwds-components.md4.0 KB
- references/working-with-design-systems/wwds-effect-styles.md3.2 KB
- references/working-with-design-systems/wwds-text-styles.md5.9 KB
- references/working-with-design-systems/wwds-variables--creating.md1.5 KB
- references/working-with-design-systems/wwds-variables--using.md1.9 KB
- references/working-with-design-systems/wwds-variables.md4.6 KB
- references/working-with-design-systems/wwds.md5.1 KB
Questions about figma-use
- Is figma-use safe to install?
- Our scanner gave figma-use grade A (92/100): no meaningful risk found. It matched 2 rule(s); review them below before installing. Static analysis cannot prove safety, so pin the reviewed revision with a lockfile.
- How do I install figma-use in Claude Code or Codex?
- Run skillhash add github:openai/skills/skills/.curated/figma-use. It downloads the exact commit, checks the grade against your policy, writes skills.lock and installs it into .claude/skills and .agents/skills.
- What happens if figma-use changes upstream?
- Its content hash changes. skillhash verify fails in CI until you review the new version and update the lock. With a watch, you also get an alert.
More from openai/skills
- A
figma-create-new-file
28kopenai/skills
Create a new blank Figma file. Use when the user wants to create a new Figma design or FigJam file, or when you need a new file before calling use_figma. Handles plan resolution via whoami if needed. Usage — /figma-create-new-file [editorType] [fileName] (e.g. /figma-create-new-file figjam My Whiteboard)
No security findings - A
cli-creator
28kopenai/skills
Build a composable CLI for Codex from API docs, an OpenAPI spec, existing curl examples, an SDK, a web app, an admin tool, or a local script. Use when the user wants Codex to create a command-line tool that can run from any repo, expose composable read/write commands, return stable JSON, manage auth, and pair with a companion skill.
No security findings - A
figma-create-design-system-rules
28kopenai/skills
Generates custom design system rules for the user's codebase. Use when user says "create design system rules", "generate rules for my project", "set up design rules", "customize design system guidelines", or wants to establish project-specific conventions for Figma-to-code workflows. Requires Figma MCP server connection.
No security findings - A
define-goal
28kopenai/skills
Help the user define a concrete, measurable goal before starting work, especially when they ask to use the goal tool, create a goal, set an objective, clarify success criteria, or turn a fuzzy intention into a quantitative outcome. Use this skill for goal creation and goal refinement only; it does not manage durable snapshots, decision logs, or long-running execution artifacts.
No security findings - A
figma-generate-design
28kopenai/skills
Use this skill alongside figma-use when the task involves translating an application page, view, or multi-section layout into Figma. Triggers: 'write to Figma', 'create in Figma from code', 'push page to Figma', 'take this app/page and build it in Figma', 'create a screen', 'build a landing page in Figma', 'update the Figma screen to match code'. This is the preferred workflow skill whenever the user wants to build or update a full page, screen, or view in Figma from code or a description. Discovers design system components, variables, and styles via search_design_system, imports them, and assembles screens incrementally section-by-section using design system tokens instead of hardcoded values.
No security findings - A
figma
28kopenai/skills
Use the Figma MCP server to fetch design context, screenshots, variables, and assets from Figma, and to translate Figma nodes into production code. Trigger when a task involves Figma URLs, node IDs, design-to-code implementation, or Figma MCP setup and troubleshooting.
No security findings - A
aspnet-core
28kopenai/skills
Build, review, refactor, or architect ASP.NET Core web applications using current official guidance for .NET web development. Use when working on Blazor Web Apps, Razor Pages, MVC, Minimal APIs, controller-based Web APIs, SignalR, gRPC, middleware, dependency injection, configuration, authentication, authorization, testing, performance, deployment, or ASP.NET Core upgrades.
No security findings - A
figma-generate-library
28kopenai/skills
Build or update a professional-grade design system in Figma from a codebase. Use when the user wants to create variables/tokens, build component libraries, set up theming (light/dark modes), document foundations, or reconcile gaps between code and Figma. This skill teaches WHAT to build and in WHAT ORDER — it complements the `figma-use` skill which teaches HOW to call the Plugin API. Both skills should be loaded together.
No security findings