Borrowing it
Nothing to install: this file belongs to epam/ai-dial-chat. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/epam/ai-dial-chat/development/.claude/skills/figma/SKILL.mdgit clone --depth 1 https://github.com/epam/ai-dial-chatWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/epam/ai-dial-chat/figma)<a href="https://agentmods.dev/skills/epam/ai-dial-chat/figma"><img src="https://agentmods.dev/badge/skills/epam/ai-dial-chat/figma/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/epam/ai-dial-chat/figma"><img src="https://agentmods.dev/badge/skills/epam/ai-dial-chat/figma.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Agent Snooping · line 31 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Excessive Agency · line 76 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00032 | $0.00916 |
| Opus 5.5 | $0.00013 | $0.00366 |
| Sonnet 5.5 | $0.00006 | $0.00183 |
| Haiku 4.5 | $0.00003 | $0.00092 |
Grade A, and why
figma scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Figma Design-to-Code
Overview
Translate Figma designs into production-ready React components that match project conventions: React 19, Tailwind CSS, TypeScript, and @epam/ai-dial-ui-kit.
When to Use
- User shares a
figma.comURL - User says "implement this design" or "build this screen"
- User asks to match a Figma component or layout
Workflow
Step 1 — Fetch the design
Call get_design_context with the fileKey and nodeId extracted from the URL.
URL parsing rules:
figma.com/design/:fileKey/...?node-id=:nodeId→ replace-with:in nodeIdfigma.com/board/:fileKey/...→ FigJam file, useget_figjaminstead
If the design context includes Code Connect snippets, prefer those — they map directly to codebase components.
Responsive variants. Before fetching, scan the file for sibling frames at mobile vs. desktop sizes (typically 375/390 and 1280/1440/1920). When both exist, fetch both node IDs and reconcile the divergences (layout swaps, hidden sections, drawer vs. sidebar) before writing code. When only desktop is provided, ask the user before deriving a mobile version rather than guessing. See .claude/skills/responsive-design/SKILL.md for the breakpoint mapping and decision rubric.
Step 2 — Map to project components
Before writing any new code, check whether ui-kit or existing project components cover the need:
| Design need | Check first |
|---|---|
| Buttons, inputs, modals, icons | @epam/ai-dial-ui-kit |
| Generic icons | @tabler/icons-react |
| Layout, spacing, color | Tailwind CSS classes |
| Project-specific patterns | libs/ and apps/ in this monorepo |
Grep the codebase before building from scratch:
Grep("ComponentName", path="libs/")
Step 3 — Implement
- Write TypeScript + JSX; no plain JS
- Use
async/awaitwithtry/catch/finallyfor frontend async flows; avoid Promise chains with.then()/.catch() - Use Tailwind for all styling — no inline styles, no CSS modules unless they already exist in the target file
- Do not copy raw hex colors from Figma; map to Tailwind tokens or CSS variables already in the project
- Match the naming conventions of surrounding files (PascalCase components, kebab-case files)
- Name React event callback props
onEventand component-local handlershandleEvent - Keep components small and focused — split at logical boundaries, not at line count
- When implementing under
libs/*, keep the component host-agnostic: no host-owned integration details such as/apiURLs, generated clients, server-api imports, app contexts, auth/session/cookie/env access, feature flags, route/navigation knowledge, analytics/telemetry, SDK setup, platform bridges, app-specific URL schemes, or storage keys/schemas. Expose props/callbacks/resolved values for app behavior instead.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 79 lines · 32 tokens per session scan A 105643760901
figma is a skill published in the GitHub repository epam/ai-dial-chat (502 stars, last pushed today), licensed Apache-2.0. It adds 32 tokens to every session and 916 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
figma
Design-to-code workflow for Figma designs. Use when the user shares a Figma URL or asks to implement a design into the codebase.
anatomy
Explain an idea as an interactive isometric machine figure.
ip-as-logo
Design minimal cute IP mascot marks readable at 32px.
archify
Validated interactive HTML diagrams, upstream-maintained.
html-artifacts
Author the HTML for a plan artifact, dashboard iframe, or Slack attachment — structure, design plan, available runtime, theming, and craft. Read this before writing HTML for saveplan, outputiframe, or slackattachhtml.
show-me
Help the user understand the current topic visually with concise diagrams, code-shape sketches, and focused HTML artifacts.