Borrowing it
Nothing to install: this file belongs to let-sunny/canicode. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/let-sunny/canicode/main/.claude/skills/canicode-gotchas/SKILL.mdgit clone --depth 1 https://github.com/let-sunny/canicodeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/let-sunny/canicode/canicode-gotchas)<a href="https://agentmods.dev/skills/let-sunny/canicode/canicode-gotchas"><img src="https://agentmods.dev/badge/skills/let-sunny/canicode/canicode-gotchas/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/let-sunny/canicode/canicode-gotchas"><img src="https://agentmods.dev/badge/skills/let-sunny/canicode/canicode-gotchas.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00226 | $0.04663 |
| Opus 5 | $0.00113 | $0.02331 |
| Sonnet 5 | $0.00045 | $0.00933 |
| Haiku 4.5 | $0.00023 | $0.00466 |
Grade B, and why
canicode-gotchas scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads MCP configurationmediumAgent snooping
mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.
- **canicode MCP** (recommended): Register the server with your host — **Claude Code:** `claude mcp add canicode -- npx --yes --package=canicode canicode-mcp` — long-form flags only; the short-form `-y -p` collides with How it starts
The opening of the file, as written. The whole thing — 258 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CanICode Gotchas — Design Gotcha Survey
Channel contrast: canicode-gotchas (this skill) persists answers only in local .claude/skills/canicode-gotchas/SKILL.md — memo-only, no Plugin write to Figma. canicode-roundtrip writes to the canvas. Use gotchas when you want Q&A captured for code-gen context without mutating the file.
Run a gotcha survey on a Figma design to collect implementation context that Figma cannot encode natively, capture developer/designer answers, and upsert them into .claude/skills/canicode-gotchas/SKILL.md so downstream figma-implement-design runs have annotation-ready context. In this model, rules do rule-based best-practice detection, and gotcha is the annotation output from that detection. Some gotchas come from violation rules (what is wrong and how to resolve it); others come from info-collection rules (neutral context Figma cannot represent, like interaction intent/state).
Install location: The workflow prose may live under .claude/skills/canicode-gotchas/SKILL.md (default canicode init) or be copied to .cursor/skills/canicode-gotchas/SKILL.md (canicode init --cursor-skills). The authoritative gotcha store is always .claude/skills/canicode-gotchas/SKILL.md — the CLI upsert-gotcha-section writes there only. In the .claude copy, this file has two regions: the Workflow below (installed by canicode init, never overwritten manually) and the Collected Gotchas region at the bottom (one numbered section per design, replaced in place on re-runs).
Prerequisites
- canicode MCP (recommended): Register the server with your host — Claude Code:
claude mcp add canicode -- npx --yes --package=canicode canicode-mcp— long-form flags only; the short-form-y -pcollides withclaude mcp add's parser (#366); do not pass-e FIGMA_TOKEN=…here (#364). Cursor / other hosts: addcanicode-mcpto your MCP config — see Customization guide (~/.cursor/mcp.jsonor project.cursor/mcp.json). The MCP server readsFIGMA_TOKENfrom~/.canicode/config.jsonor the environment. - Without canicode MCP (fallback):
npx canicode gotcha-survey "<input>" --json— same JSON shape as the MCP tool. - FIGMA_TOKEN configured for live Figma URLs.
- Gotcha destination on disk:
.claude/skills/canicode-gotchas/SKILL.mdmust exist before upsert — runnpx canicode init --token …(add--cursor-skillsif you also want the workflow file under.cursor/skills/).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 258 lines · 226 tokens per session scan B 968f5c493465
canicode-gotchas is a skill published in the GitHub repository let-sunny/canicode (10 stars, last pushed 2mo ago), licensed MIT. It adds 226 tokens to every session and 4,663 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it B with 1 finding (reads mcp configuration). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
figma-codegen
Generate framework-aware code from a Figma design. Reads the project's stack profile and emits code matching the existing framework (React/Vue/Svelte/Next/etc.) and styling (Tailwind/CSS/CSS-in-JS), reusing existing components and design tokens instead of regenerating from scratch. Triggers whenever the user wants a…
refero-design
Primary/default skill for UI design, product design, web design, landing pages, dashboards, product screens, redesigns, visual polish, frontend/CSS styling, design systems, components, responsive design, typography, color, spacing, motion, icons, accessibility, copywriting, conversion, and anti-AI-slop work. Use this…
figma-build
Build a Figma design from code or a description — the reverse of figma-codegen. Reuses the connected file's existing design system (components, variables, styles) instead of drawing primitives with hardcoded values. Triggers whenever the user wants something created or updated IN Figma from code or a spec — e.g.…
generating-figma-design
Use when the user requests to design, create, build, generate, or make a new Figma component or screen — including phrases like "make a button", "design a settings page", "build a new card", "generate X". Produces a CSpec, compiles it to a scene graph, executes it in Figma via MCP, and verifies the output.
learning-from-corrections
Use when the user says they adjusted the design in Figma, mentions "fix", "correct", "learn from", "I changed", "diff", "what changed", or wants the system to incorporate manual Figma edits back into the spec. Diffs the current Figma state against the last snapshot, classifies each change as a DS learning or a…
generate-figma-screen
Kod veya açıklamadan Figma'da tam ekran/sayfa oluşturur. Yayınlanmış design system bileşenlerini arayıp instance olarak yerleştirir; hardcode değer yerine DS token'larını kullanır. "Figma'da ekran oluştur", "kodu Figma'ya çevir", "landing page çiz", "ekran tasarla", "generate screen", "UI'ı Figma'ya aktar"…