Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description (generate component-library‑aligned front-end code from Figma) match the instructions: the SKILL.md describes extracting frames, styles, mapping to components/tokens and producing React code. Nothing requested (no binaries, no env vars) appears unrelated to the stated purpose. The only external dependency the instructions expect is a Figma MCP connection (MCP server or Figma-Context-MCP), which is coherent for a Figma integration but is not declared as a required credential in the registry metadata.
Instruction Scope
Instructions stay on task: fetch selected Frame via MCP, extract styles/variables/components, map to the user's component library and design tokens, and generate code. The doc does not instruct the agent to read arbitrary system files, secrets, or unrelated configuration. It does permit some open-ended mapping decisions (e.g., find best-match components in the user's library), which is expected for code-generation but could lead to broad reads of project documentation if the agent has access — confirm what project artifacts the agent will actually be allowed to access at runtime.
Install Mechanism
This is an instruction-only skill with no install spec and no bundled code. That is the lowest-risk install profile — nothing will be written to disk by the skill itself.
Credentials
The skill declares no required environment variables or credentials, which is consistent with the registry metadata. However, the SKILL.md explicitly expects a Figma MCP connection (official MCP or Figma-Context-MCP). If your platform provides a built-in Figma connector this is reasonable; if the skill expects the agent to call an external MCP endpoint you should confirm which credentials/endpoints will be used and whether any tokens are required or stored.
Persistence & Privilege
The skill does not request always: true and makes no claims about modifying other skills or persisting system-wide configuration. Autonomous invocation (model-invocation enabled) is the platform default and appropriate for this type of skill.
Assessment
This skill appears coherent for generating component-library-aligned React code from Figma. Before installing: 1) Confirm how the Figma MCP connection is provided (platform-built connector vs. an external endpoint) and whether any API tokens will be used or stored. 2) Verify that the agent will not be granted access to unrelated repos or system secrets while doing component-matching. 3) Review any generated code before using it in production (check tokens, ARIA/accessibility, and external calls). 4) If you are concerned about automatic access to your private Figma files, restrict the skill's runtime permissions or avoid enabling autonomous invocation.Like a lobster shell, security has layers — review code before you run it.
latestvk97as4serztzwp2ddsxrhm74f183npv8
License
MIT-0
Free to use, modify, and redistribute. No attribution required.