stacklok · danbarr · Aug 11, 2026
diff --git a/skills/figma-code-connect/spec.yaml b/skills/figma-code-connect/spec.yaml
@@ -0,0 +1,38 @@
+# Figma figma-code-connect Skill
+# Source: https://github.com/figma/mcp-server-guide
+# Usage governed by the Figma Developer Terms (https://www.figma.com/legal/developer-terms/) — no separate OSS
+# license is declared in this repo.
+# Will publish as: ghcr.io/stacklok/dockyard/skills/figma-code-connect:0.1.0
+
+metadata:
+  name: figma-code-connect
+  description: Creates and maintains Figma Code Connect template files that map Figma components to code
+    snippets. Use when the user mentions Code Connect, Figma component mapping, design-to-code translation,
+    or asks to create/update .figma.ts or .figma.js files.
+
+spec:
+  repository: "https://github.com/figma/mcp-server-guide"
+  ref: "22b2c566d98880ebdb5a8e48eb2c66c596a6d990"  # main as of 2026-08-11
+  path: "skills/figma-code-connect"
+  version: "0.1.0"
+
+provenance:
+  repository_uri: "https://github.com/figma/mcp-server-guide"
+  repository_ref: "refs/heads/main"
+
+security:
+  allowed_issues:
+    - rule_id: MANIFEST_MISSING_LICENSE
+      reason: "figma/mcp-server-guide declares no OSS license (no LICENSE file, none detected by GitHub); usage of the Figma MCP server and these skills is governed by the Figma Developer Terms (https://www.figma.com/legal/developer-terms/), referenced in the repo README."
+    - rule_id: ATR_2026_00012
+      reason: "FP: matched code-example tokens (e.g. references/api.md:645) in JS/Plugin-API code snippets or shell examples — legitimate example code, not a hidden execution primitive."
+    - rule_id: ATR_2026_00051
+      reason: "FP: matched \"every item\"/\"all files\"/an example SQL string in documented code snippets (e.g. references/api.md:567), not a bulk-exfiltration action."
+    - rule_id: ATR_2026_00066
+      reason: "FP: matched JS/template string interpolation (`${...}`) or relative doc-link paths (`../../`) in documented code examples (e.g. SKILL.md:224, SKILL.md:232) — standard syntax, not injected secrets."
+    - rule_id: ATR_2026_00090
+      reason: "FP: matched \"Extract `fileKey`\"/\"extract token\" describing how to parse a Figma URL or Plugin API return value in documentation (e.g. SKILL.md:26), not credential extraction."
+    - rule_id: ATR_2026_00091
+      reason: "FP: matched escaped newline sequences (`\\n`) or similar tokens in documented code examples (e.g. SKILL.md:423, references/advanced-patterns.md:114), not an obfuscation pattern."
+    - rule_id: ATR_2026_01610
+      reason: "FP: matched backtick-quoted inline code formatting in markdown (e.g. references/api.md:69) — standard Markdown code-span syntax, not shell subshell command substitution."
diff --git a/skills/figma-create-new-file/spec.yaml b/skills/figma-create-new-file/spec.yaml
@@ -0,0 +1,30 @@
+# Figma figma-create-new-file Skill
+# Source: https://github.com/figma/mcp-server-guide
+# Usage governed by the Figma Developer Terms (https://www.figma.com/legal/developer-terms/) — no separate OSS
+# license is declared in this repo.
+# Will publish as: ghcr.io/stacklok/dockyard/skills/figma-create-new-file:0.1.0
+
+metadata:
+  name: figma-create-new-file
+  description: '**MANDATORY prerequisite** — you MUST invoke this skill BEFORE every `create_new_file` tool
+    call. NEVER call `create_new_file` directly without loading this skill first. Trigger whenever the user
+    wants a new blank Figma file — a new design, FigJam, or Slides file — or when you need a fresh file
+    before calling `use_figma`. Usage — /figma-create-new-file [editorType] [fileName] (e.g. /figma-create-new-file
+    figjam My Whiteboard, /figma-create-new-file slides Q3 Review)'
+
+spec:
+  repository: "https://github.com/figma/mcp-server-guide"
+  ref: "22b2c566d98880ebdb5a8e48eb2c66c596a6d990"  # main as of 2026-08-11
+  path: "skills/figma-create-new-file"
+  version: "0.1.0"
+
+provenance:
+  repository_uri: "https://github.com/figma/mcp-server-guide"
+  repository_ref: "refs/heads/main"
+
+security:
+  allowed_issues:
+    - rule_id: MANIFEST_MISSING_LICENSE
+      reason: "figma/mcp-server-guide declares no OSS license (no LICENSE file, none detected by GitHub); usage of the Figma MCP server and these skills is governed by the Figma Developer Terms (https://www.figma.com/legal/developer-terms/), referenced in the repo README."
+    - rule_id: ATR_2026_00111
+      reason: "FP: matched `whoami`/`curl` used in a documented troubleshooting or asset-download example (e.g. SKILL.md:28, SKILL.md:30), not a live recon/download action."
diff --git a/skills/figma-design-to-code/spec.yaml b/skills/figma-design-to-code/spec.yaml
@@ -0,0 +1,31 @@
+# Figma figma-design-to-code Skill
+# Source: https://github.com/figma/mcp-server-guide
+# Usage governed by the Figma Developer Terms (https://www.figma.com/legal/developer-terms/) — no separate OSS
+# license is declared in this repo.
+# Will publish as: ghcr.io/stacklok/dockyard/skills/figma-design-to-code:0.1.0
+
+metadata:
+  name: figma-design-to-code
+  description: '**MANDATORY prerequisite** — you MUST invoke this skill BEFORE calling the `get_design_context`
+    Figma MCP tool. You MUST trigger this skill whenever the user wants to implement, build, port, or code
+    up a Figma design as code. Example prompts (not exhaustive) are ''implement this Figma design'', ''build
+    this screen from Figma'', ''turn this Figma into code'', ''design to code''. This skill provides critical
+    instructions and steps to the agent on how to correctly implement Figma designs in code and must NOT
+    be skipped.'
+
+spec:
+  repository: "https://github.com/figma/mcp-server-guide"
+  ref: "22b2c566d98880ebdb5a8e48eb2c66c596a6d990"  # main as of 2026-08-11
+  path: "skills/figma-design-to-code"
+  version: "0.1.0"
+
+provenance:
+  repository_uri: "https://github.com/figma/mcp-server-guide"
+  repository_ref: "refs/heads/main"
+
+security:
+  allowed_issues:
+    - rule_id: MANIFEST_MISSING_LICENSE
+      reason: "figma/mcp-server-guide declares no OSS license (no LICENSE file, none detected by GitHub); usage of the Figma MCP server and these skills is governed by the Figma Developer Terms (https://www.figma.com/legal/developer-terms/), referenced in the repo README."
+    - rule_id: ATR_2026_00140
+      reason: "FP: matched \"reverse\"/\"opposite\"/\"inverse\" in comparative documentation prose (e.g. SKILL.md:3)."
diff --git a/skills/figma-generate-design/spec.yaml b/skills/figma-generate-design/spec.yaml
@@ -0,0 +1,44 @@
+# Figma figma-generate-design Skill
+# Source: https://github.com/figma/mcp-server-guide
+# Usage governed by the Figma Developer Terms (https://www.figma.com/legal/developer-terms/) — no separate OSS
+# license is declared in this repo.
+# Will publish as: ghcr.io/stacklok/dockyard/skills/figma-generate-design:0.1.0
+
+metadata:
+  name: figma-generate-design
+  description: 'Use this skill alongside figma-use when the task involves translating an application page,
+    view, or multi-section layout into Figma. Triggers: ''write to Figma'', ''create in Figma from code'',
+    ''push page to Figma'', ''take this app/page and build it in Figma'', ''create a screen'', ''build a
+    landing page in Figma'', ''update the Figma screen to match code'', ''convert this modal/dialog/drawer/panel
+    to Figma''. This is the preferred workflow skill whenever the user wants to build or update a full page,
+    modal, dialog, drawer, sidebar, panel, or any composed multi-section view in Figma from code or a description.
+    Discovers design system components, variables, and styles from Code Connect files, existing screens,
+    and library search, then imports them and assembles views incrementally section-by-section using design
+    system tokens instead of hardcoded values.'
+
+spec:
+  repository: "https://github.com/figma/mcp-server-guide"
+  ref: "22b2c566d98880ebdb5a8e48eb2c66c596a6d990"  # main as of 2026-08-11
+  path: "skills/figma-generate-design"
+  version: "0.1.0"
+
+provenance:
+  repository_uri: "https://github.com/figma/mcp-server-guide"
+  repository_ref: "refs/heads/main"
+
+security:
+  allowed_issues:
+    - rule_id: MANIFEST_MISSING_LICENSE
+      reason: "figma/mcp-server-guide declares no OSS license (no LICENSE file, none detected by GitHub); usage of the Figma MCP server and these skills is governed by the Figma Developer Terms (https://www.figma.com/legal/developer-terms/), referenced in the repo README."
+    - rule_id: ATR_2026_00012
+      reason: "FP: matched code-example tokens (e.g. SKILL.md:188, SKILL.md:444) in JS/Plugin-API code snippets or shell examples — legitimate example code, not a hidden execution primitive."
+    - rule_id: ATR_2026_00040
+      reason: "FP: matched \"truncate\"/\"TRUNCATE\" describing text-truncation or table-formatting behavior in documentation (e.g. SKILL.md:376), not a destructive data operation."
+    - rule_id: ATR_2026_00063
+      reason: "FP: matched words like \"upload\"/\"compress\"/\"webhook\" describing legitimate Figma/FigJam features (asset upload, image compression, diagram composition) in documentation (e.g. references/discover-product-font.md:19, references/discover-product-font.md:58), not exfiltration code."
+    - rule_id: ATR_2026_00066
+      reason: "FP: matched JS/template string interpolation (`${...}`) or relative doc-link paths (`../../`) in documented code examples (e.g. references/discover-product-font.md:53) — standard syntax, not injected secrets."
+    - rule_id: ATR_2026_00083
+      reason: "FP: matched \"# Override ...\" code comments describing configuration precedence in documented examples (e.g. SKILL.md:304), not an override instruction to the agent."
+    - rule_id: ATR_2026_02009
+      reason: "FP: matched a bare \"key:\" in a markdown table documenting Plugin API property names (e.g. SKILL.md:75), not a prompt-injection prompt for a missing secret."
diff --git a/skills/figma-generate-diagram/spec.yaml b/skills/figma-generate-diagram/spec.yaml
@@ -0,0 +1,51 @@
+# Figma figma-generate-diagram Skill
+# Source: https://github.com/figma/mcp-server-guide
+# Usage governed by the Figma Developer Terms (https://www.figma.com/legal/developer-terms/) — no separate OSS
+# license is declared in this repo.
+# Will publish as: ghcr.io/stacklok/dockyard/skills/figma-generate-diagram:0.1.0
+
+metadata:
+  name: figma-generate-diagram
+  description: MANDATORY prerequisite — load this skill BEFORE every `generate_diagram` tool call. NEVER
+    call `generate_diagram` directly without loading this skill first. Trigger whenever the user asks to
+    create, generate, draw, render, sketch, or build a diagram — flowchart, architecture diagram, sequence
+    diagram, ERD or entity-relationship diagram, state diagram or state machine, gantt chart, or timeline.
+    Also trigger when the user mentions Mermaid syntax or wants a system architecture, decision tree, dependency
+    graph, API call flow, auth handshake, schema, or pipeline visualized in FigJam. Routes to type-specific
+    guidance, sets universal Mermaid constraints, and tells you when to use a different diagram type or
+    skip the tool entirely (mindmaps, pie charts, class diagrams, etc.).
+
+spec:
+  repository: "https://github.com/figma/mcp-server-guide"
+  ref: "22b2c566d98880ebdb5a8e48eb2c66c596a6d990"  # main as of 2026-08-11
+  path: "skills/figma-generate-diagram"
+  version: "0.1.0"
+
+provenance:
+  repository_uri: "https://github.com/figma/mcp-server-guide"
+  repository_ref: "refs/heads/main"
+
+security:
+  allowed_issues:
+    - rule_id: MANIFEST_MISSING_LICENSE
+      reason: "figma/mcp-server-guide declares no OSS license (no LICENSE file, none detected by GitHub); usage of the Figma MCP server and these skills is governed by the Figma Developer Terms (https://www.figma.com/legal/developer-terms/), referenced in the repo README."
+    - rule_id: ATR_2026_00001
+      reason: "FP: matched imperative-sounding phrases (e.g. references/gantt.md:144, references/gantt.md:209) in the skill's own workflow prose, not an injected directive."
+    - rule_id: ATR_2026_00012
+      reason: "FP: matched code-example tokens (e.g. SKILL.md:84) in JS/Plugin-API code snippets or shell examples — legitimate example code, not a hidden execution primitive."
+    - rule_id: ATR_2026_00051
+      reason: "FP: matched \"every item\"/\"all files\"/an example SQL string in documented code snippets (e.g. references/architecture.md:169), not a bulk-exfiltration action."
+    - rule_id: ATR_2026_00063
+      reason: "FP: matched words like \"upload\"/\"compress\"/\"webhook\" describing legitimate Figma/FigJam features (asset upload, image compression, diagram composition) in documentation (e.g. references/architecture.md:123), not exfiltration code."
+    - rule_id: ATR_2026_00066
+      reason: "FP: matched JS/template string interpolation (`${...}`) or relative doc-link paths (`../../`) in documented code examples (e.g. references/erd.md:232, references/flowchart.md:42) — standard syntax, not injected secrets."
+    - rule_id: ATR_2026_00084
+      reason: "FP: matched \"ignore\" describing a specific documented prop/field to disregard in a code example (e.g. references/flowchart.md:130), not an instruction to ignore safety guidance."
+    - rule_id: ATR_2026_00091
+      reason: "FP: matched escaped newline sequences (`\\n`) or similar tokens in documented code examples (e.g. SKILL.md:45, references/flowchart.md:46), not an obfuscation pattern."
+    - rule_id: ATR_2026_00140
+      reason: "FP: matched \"reverse\"/\"opposite\"/\"inverse\" in comparative documentation prose (e.g. references/architecture.md:111, references/erd.md:35)."
+    - rule_id: ATR_2026_01980
+      reason: "FP: matched ER-diagram cardinality terminology (\"A side\"/\"B side\", references/erd.md:162) — coincidental substring overlap with an unrelated CVE signature for a different, unrelated MCP server package; no code execution or attacker-influenceable parameters here."
+    - rule_id: PG_PII_SSN_HARVESTING
+      reason: "FP: matched \"composin\" (from \"composing\") in ordinary documentation prose (e.g. SKILL.md:70), not SSN collection."
diff --git a/skills/figma-generate-library/spec.yaml b/skills/figma-generate-library/spec.yaml
@@ -0,0 +1,53 @@
+# Figma figma-generate-library Skill
+# Source: https://github.com/figma/mcp-server-guide
+# Usage governed by the Figma Developer Terms (https://www.figma.com/legal/developer-terms/) — no separate OSS
+# license is declared in this repo.
+# Will publish as: ghcr.io/stacklok/dockyard/skills/figma-generate-library:0.1.0
+
+metadata:
+  name: figma-generate-library
+  description: Build or update a professional-grade design system in Figma from a codebase. Use when the
+    user wants to create variables/tokens, build component libraries, create individual components with
+    proper variant sets and variable bindings, set up theming (light/dark modes), document foundations,
+    or reconcile gaps between code and Figma. Also use when the user asks to create or generate any component
+    in Figma — even a single one — since components require proper variable foundations, variant states,
+    and design token bindings to be production-quality. This skill teaches WHAT to build and in WHAT ORDER
+    — it complements the `figma-use` skill which teaches HOW to call the Plugin API. Both skills should
+    be loaded together.
+
+spec:
+  repository: "https://github.com/figma/mcp-server-guide"
+  ref: "22b2c566d98880ebdb5a8e48eb2c66c596a6d990"  # main as of 2026-08-11
+  path: "skills/figma-generate-library"
+  version: "0.1.0"
+
+provenance:
+  repository_uri: "https://github.com/figma/mcp-server-guide"
+  repository_ref: "refs/heads/main"
+
+security:
+  allowed_issues:
+    - rule_id: MANIFEST_MISSING_LICENSE
+      reason: "figma/mcp-server-guide declares no OSS license (no LICENSE file, none detected by GitHub); usage of the Figma MCP server and these skills is governed by the Figma Developer Terms (https://www.figma.com/legal/developer-terms/), referenced in the repo README."
+    - rule_id: ATR_2026_00001
+      reason: "FP: matched imperative-sounding phrases (e.g. references/discovery-phase.md:472, references/discovery-phase.md:518) in the skill's own workflow prose, not an injected directive."
+    - rule_id: ATR_2026_00003
+      reason: "FP: matched \"Switch to Dev Mode\" (references/code-connect-setup.md:246) — Figma's own named UI feature for developers to inspect specs, not an AI jailbreak \"developer mode\" attempt."
+    - rule_id: ATR_2026_00012
+      reason: "FP: matched code-example tokens (e.g. references/component-creation.md:53, references/discovery-phase.md:77) in JS/Plugin-API code snippets or shell examples — legitimate example code, not a hidden execution primitive."
+    - rule_id: ATR_2026_00032
+      reason: "FP: matched comparative \"instead of ...\"/\"this is critical\" phrasing in documentation prose (e.g. references/naming-conventions.md:435, references/token-creation.md:486), not an override instruction."
+    - rule_id: ATR_2026_00040
+      reason: "FP: matched \"truncate\"/\"TRUNCATE\" describing text-truncation or table-formatting behavior in documentation (e.g. SKILL.md:155, references/documentation-creation.md:127), not a destructive data operation."
+    - rule_id: ATR_2026_00064
+      reason: "FP: matched inline code / timing values like \"at 0\"/\"at 3\" in documented animation-timing or API examples (e.g. SKILL.md:313, references/token-creation.md:137), not a firewall or system command."
+    - rule_id: ATR_2026_00066
+      reason: "FP: matched JS/template string interpolation (`${...}`) or relative doc-link paths (`../../`) in documented code examples (e.g. references/code-connect-setup.md:176, references/component-creation.md:9) — standard syntax, not injected secrets."
+    - rule_id: ATR_2026_00088
+      reason: "FP: matched \"return await clean...\"/\"return { clean...\" in example error-recovery code (e.g. references/error-recovery.md:44), not an output-billing or cost-evasion pattern."
+    - rule_id: ATR_2026_00090
+      reason: "FP: matched \"Extract `fileKey`\"/\"extract token\" describing how to parse a Figma URL or Plugin API return value in documentation (e.g. SKILL.md:59, references/discovery-phase.md:67), not credential extraction."
+    - rule_id: ATR_2026_00091
+      reason: "FP: matched escaped newline sequences (`\\n`) or similar tokens in documented code examples (e.g. references/documentation-creation.md:549), not an obfuscation pattern."
+    - rule_id: ATR_2026_02009
+      reason: "FP: matched a bare \"key:\" in a markdown table documenting Plugin API property names (e.g. references/component-creation.md:568), not a prompt-injection prompt for a missing secret."