跳到主要内容
知仓学习社ZHICANG

understand-figma

Analyze a Figma file via the Figma REST API and generate an interactive design knowledge graph (pages, screens, components, component sets, instance…

读凭据写文件读文件严重 0 · 高危 1Egonex-AI/Understand-Anything

它会碰到什么

扫了多少3 个文本文件,10 KB
它会碰到什么读凭据写文件读文件
命中总数13 处
命中统计严重 0 · 高 1 · 中 12 · 低 0
逐条看命中(1 条严重或高危)
  • figma-scan.mjs:29cred-envread
    if (doc.version && prevVersion === doc.version && process.env.UNDERSTAND_FIGMA_FORCE !== "1") {

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

/understand-figma

Analyzes a Figma file and produces an interactive design knowledge graph in the existing dashboard.

Prerequisites

  • FIGMA_TOKEN environment variable — a Figma personal access token (create one at https://www.figma.com/settings). If it is missing, STOP and tell the user:

> Set a Figma token first: create one at figma.com/settings, then export FIGMA_TOKEN=<token>.

  • Node ≥ 22, pnpm ≥ 10.

> Security: the token is read only from the environment and travels only in the X-Figma-Token request header. Never write it to the graph, meta.json, logs, or intermediate files. This skill makes outbound calls to api.figma.com — unlike /understand, it is not fully offline. Tell the user this once.

Phase 0 — Pre-flight

  1. Parse $ARGUMENTS for a Figma URL or bare file key (the non-flag token) and an optional --language <lang>.
  2. Resolve PROJECT_ROOT to the current working directory. Resolve the data directory $UA_DIR once and reuse it for every read and write below: UA_DIR="$PROJECT_ROOT/$([ -d "$PROJECT_ROOT/.understand-anything" ] && echo .understand-anything || echo .ua)" — the legacy .understand-anything/ when it already exists, otherwise the new .ua/. Because each phase may run in a fresh shell, carry $UA_DIR forward like $PROJECT_ROOT, re-resolving it with the same line if a later command block needs it.
  3. Resolve PLUGIN_ROOT and ensure core is built (same logic as /understand Phase 0.1.5). If packages/core/dist/figma/index.js is missing, run:
   cd "$PLUGIN_ROOT" && (pnpm install --frozen-lockfile 2>/dev/null || pnpm install) && pnpm --filter @understand-anything/core build
  1. mkdir -p $UA_DIR/intermediate.

Phase 1 — FETCH & PARSE (deterministic)

Run the bundled scan script (<SKILL_DIR> is this skill's directory):

FIGMA_TOKEN="$FIGMA_TOKEN" node <SKILL_DIR>/figma-scan.mjs "$PROJECT_ROOT" "<url-or-key>"

It writes $UA_DIR/intermediate/scan-manifest.json and prints the node counts. Relay the counts to the user. If it exits non-zero, relay stderr and STOP.

> If the scan prints UP_TO_DATE, report "Design graph is already up to date for this Figma file version" and STOP. To force a full rebuild, re-run with UNDERSTAND_FIGMA_FORCE=1 set in the environment.

Phase 2 — ANALYZE (LLM enrichment)

  1. Read scan-manifest.json. Group nodes into batches of ~15, grouped by page when possible.
  2. For each batch, dispatch a subagent using the design-analyzer agent definition (agents/design-analyzer.md). Pass:
  • the batch of nodes (id, type, name, figmaMeta, child names, token usage),
  • the full list of existing node IDs,
  • $INTERMEDIATE_DIR = $UA_DIR/intermediate,
  • the batch number for output naming.

The agent writes analysis-batch-<N>.json.

Append $LANGUAGE_DIRECTIVE if --language was provided (reuse /understand's directive text).

  1. Run up to 5 batches concurrently. If a batch fails, log a warning and continue — the manifest is a solid base.

Phase 3 — MERGE

node <SKILL_DIR>/figma-merge.mjs "$PROJECT_ROOT"

It combines scan-manifest.json + analysis-batch-*.json, runs mergeDesignGraph (validates, re-attaches kind:"design"), and writes knowledge-graph.json + meta.json. Relay the printed stats and any non-auto-corrected issues.

Phase 4 — SAVE & LAUNCH

  1. Clean up intermediate files except scan-manifest.json:
   INTER="$UA_DIR/intermediate"
   find "$INTER" -mindepth 1 -maxdepth 1 -not -name 'scan-manifest.json' -exec rm -rf {} +
  1. Report a summary: project name, counts by node type, edges by type, layers, tour steps, and the path $UA_DIR/knowledge-graph.json.
  2. Auto-launch the dashboard by invoking the /understand-dashboard skill.

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。

它属于哪个仓库

星标★ 83,053
本站分层T1
该仓技能数9
原文件路径understand-anything-plugin/skills/understand-figma/SKILL.md

同一个仓库里的其他技能

看这个仓库的全部 9 个技能