Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/hoshikitsunoda/figma-plugins-vibe-coding-template/figma-ui-threadgit clone --depth 1 https://github.com/hoshikitsunoda/figma-plugins-vibe-coding-templateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/hoshikitsunoda/figma-plugins-vibe-coding-template/figma-ui-thread)<a href="https://agentmods.dev/rules/hoshikitsunoda/figma-plugins-vibe-coding-template/figma-ui-thread"><img src="https://agentmods.dev/badge/rules/hoshikitsunoda/figma-plugins-vibe-coding-template/figma-ui-thread.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00658 |
| Opus 5 | $0.00000 | $0.00329 |
| Sonnet 5 | $0.00000 | $0.00132 |
| Haiku 4.5 | $0.00000 | $0.00066 |
Grade A, and why
figma-ui-thread scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Figma UI Thread (React) Rules
This code runs in an iframe with full browser APIs but NO access to figma.*.
Available APIs
- Full DOM and React
fetch()for network requestswindow,localStorage,sessionStorageparent.postMessage()to send messages to plugin
Communication with Plugin
Sending Messages to Plugin
import type { PluginMessage } from "../shared/messages";
const postToPlugin = (message: PluginMessage) => {
parent.postMessage({ pluginMessage: message }, "*");
};
// Usage
postToPlugin({ type: "get-selection" });
postToPlugin({ type: "create-rectangle", width: 100, height: 100 });
Receiving Messages from Plugin
import type { UIMessage } from "../shared/messages";
useEffect(() => {
const handleMessage = (event: MessageEvent<{ pluginMessage: UIMessage }>) => {
const msg = event.data.pluginMessage;
if (!msg) return;
switch (msg.type) {
case "selection-changed":
setSelection(msg.nodes);
break;
}
};
window.addEventListener("message", handleMessage);
return () => window.removeEventListener("message", handleMessage);
}, []);
React Patterns
Functional Components with Hooks
// ✓ Use functional components
function SelectionPanel() {
const [selection, setSelection] = useState<SelectionNode[]>([]);
// ...
}
Custom Hooks for Plugin Communication
Consider extracting message handling into a custom hook:
// src/ui/hooks/usePluginMessage.ts
function usePluginMessage<T>(type: string, handler: (data: T) => void) {
useEffect(() => {
const onMessage = (e: MessageEvent) => {
if (e.data.pluginMessage?.type === type) {
handler(e.data.pluginMessage);
}
};
window.addEventListener("message", onMessage);
return () => window.removeEventListener("message", onMessage);
}, [type, handler]);
}
Styling with Tailwind CSS
Use Tailwind utility classes with CSS variables defined in index.css. Never hardcode colors — always use variables with Tailwind v4 syntax:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 112 lines · 0 tokens per session scan A 2957b306115c
figma-ui-thread is a cursor rule published in the GitHub repository hoshikitsunoda/figma-plugins-vibe-coding-template (21 stars, last pushed 8mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 658 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
development-conventions
Development conventions, code style, and best practices for the Kaneo project.
state-management
Use the following stack. Do not introduce or recommend Redux or React Context for shared/global state.
mobx
Definitive guidelines for structuring MobX applications with React, focusing on predictable state management, optimal rendering, and modern best practices.
backend
Backend development rules for TT Studio - AI model management backend.
new-component
Workflow for creating new React components.
middleware-auth
Next.js middleware auth — prevents auth logic being placed in middleware instead of route handlers.