Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sso-ss/vibe-ship-it --skill figma-plugingit clone --depth 1 https://github.com/sso-ss/vibe-ship-itWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sso-ss/vibe-ship-it/figma-plugin)<a href="https://agentmods.dev/skills/sso-ss/vibe-ship-it/figma-plugin"><img src="https://agentmods.dev/badge/skills/sso-ss/vibe-ship-it/figma-plugin/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sso-ss/vibe-ship-it/figma-plugin"><img src="https://agentmods.dev/badge/skills/sso-ss/vibe-ship-it/figma-plugin.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00022 | $0.01711 |
| Opus 5 | $0.00011 | $0.00856 |
| Sonnet 5 | $0.00004 | $0.00342 |
| Haiku 4.5 | $0.00002 | $0.00171 |
Grade A, and why
figma-plugin scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 253 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Figma Plugin Platform
Build Figma plugins that extend the design tool. TypeScript + Figma Plugin API.
Project Structure
Explain to the designer as:
"Your plugin has two parts: the brain (logic) and the face (UI panel)."
src/
code.ts ← Plugin logic (talks to Figma canvas)
ui.html ← Plugin panel (what the user sees)
ui.ts ← Panel interactivity (optional, for complex UIs)
manifest.json ← Plugin name, permissions, entry points
tsconfig.json ← TypeScript settings
package.json ← Dependencies
figma.d.ts ← Type definitions for Figma API (auto-generated)
Scaffolding
No CLI tool — scaffold manually:
mkdir my-plugin && cd my-plugin
npm init -y
npm install -D typescript @figma/plugin-typings
Create manifest.json:
{
"name": "My Plugin",
"id": "000000000000000000",
"api": "1.0.0",
"main": "dist/code.js",
"ui": "src/ui.html",
"editorType": ["figma"]
}
Create tsconfig.json:
{
"compilerOptions": {
"target": "ES2017",
"module": "commonjs",
"outDir": "./dist",
"strict": true,
"typeRoots": ["./node_modules/@figma/plugin-typings"]
},
"include": ["src/**/*.ts"]
}
Add build script to package.json:
"scripts": {
"build": "tsc",
"watch": "tsc --watch"
}
Key Conventions
Two Worlds: Code vs UI
The plugin has two separate environments that talk to each other:
Code (code.ts) |
UI (ui.html) |
|
|---|---|---|
| Runs in | Figma's sandbox | An iframe |
| Can access | Figma canvas, nodes, styles | HTML, CSS, DOM |
| Can't access | DOM, window, fetch | Figma nodes directly |
| Communicates via | figma.ui.postMessage() |
parent.postMessage() |
"Think of it like two rooms with a mail slot. The brain room can see and change your design. The face room shows buttons and inputs. They pass notes back and forth."
Talking to the Canvas
// code.ts
// Read the current selection
const selection = figma.currentPage.selection
// Create a rectangle
const rect = figma.createRectangle()
rect.resize(200, 100)
rect.fills = [{ type: 'SOLID', color: { r: 0.2, g: 0.4, b: 1 } }]
// Create text
const text = figma.createText()
await figma.loadFontAsync({ family: "Inter", style: "Regular" })
text.characters = "Hello from the plugin!"
// Read node properties
const node = figma.currentPage.selection[0]
if (node.type === 'TEXT') {
console.log(node.characters) // the text content
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 253 lines · 22 tokens per session scan A 6e399fc31a69
figma-plugin is a skill published in the GitHub repository sso-ss/vibe-ship-it (12 stars, last pushed 5mo ago), licensed MIT. It adds 22 tokens to every session and 1,711 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
kernelcad-authoring
Author or modify kernelCAD models in TypeScript. Scripts live in .kcad.ts files; the kernelCAD CLI (kernelcad evaluate and kernelcad export stl|step|dxf|3mf|glb -o ) executes them via an OpenCASCADE WASM kernel.
kernelcad
A two-tier skill system. Load kernelcad-authoring to write or modify any .kcad.ts model. Add specialty skills as the task demands.
hyperstack
Senior Staff Engineer Persona + Unified MCP Server. Provides deep architectural discipline and deterministic knowledge across React Flow, Motion, Echo, Go, Rust, and UI/UX design systems.
no-bare-casts
Writing as in TypeScript or TSX production code, modifying a file that contains a bare as cast, silencing a type error with a cast, encountering as unknown as, or reviewing a cast site.
aws-sst-development
SST v4 (Ion) expert for managing AWS resources as code with the Pulumi-backed framework.
league-akari-shard-development
Use when creating, extending, refactoring, splitting, or reviewing League Akari main or renderer shards, including shard file organization, controller/loader/executor/handler boundaries, naming conventions, renderer TSX usage, platform guards, and public contract compatibility.