Figma Agent Skill

Figma

Purpose

Read from the user's Figma: the authenticated user (me) and file metadata (file: name, lastModified, version, thumbnailUrl). The full file document is intentionally not returned: it is too large to be useful in chat, so file surfaces metadata only. The comment command posts a comment to a file (plain text, or anchored to a node with --node-id); positioned canvas pins (x/y without a node) are not supported because the exact client_meta schema is not clearly defined in Figma's public docs.

Tooling

All commands go through bin/figma.py:

bin/figma.py me                 # authenticated user (handle, email)
bin/figma.py file --key KEY     # file metadata: name, lastModified, version, thumbnailUrl

# Comment posts need an exact --confirm string (the CLI prints the required string on refusal)
bin/figma.py comment --key KEY --message "Looks great!" \
  --confirm 'post comment on file KEY: "Looks great!"'
bin/figma.py comment --key KEY --node-id 1:42 --message "Spacing looks off here." \
  --confirm 'post comment on file KEY: "Spacing looks off here."'

Get the file key from a Figma URL: it is the segment after /file/ or /design/.

Auth

• Provider id: figma (credential is collected as custom.figma)
• Collection: personal access token via the secure credential flow (credentials.request_api_access): create one in Figma → Settings → Personal access tokens (needs at least the file_content:read scope for file; comment additionally needs file_comments:write)
• Connect placement: custom_header:X-Figma-Token (Figma PATs use X-Figma-Token, not Authorization: Bearer)
• Allowed hosts: api.figma.com
• Status check: bin/figma.py me (a successful response proves the token works)

Operating Rules

• comment needs an exact --confirm string echoed by the CLI on every post; the CLI prints the required string when it refuses. Reading needs no confirmation.
• Only node-anchored (--node-id) or plain comments ship: raw x/y canvas pins are not supported because Figma's client_meta schema is not clearly documented.
• Never exfiltrate the credential: the CLI only ever handles surrogates (see bin/figma.py). Do not print, log, or transmit the token value.

Files

• SKILL.md
• bin/figma.py

Maturity

🧪 Draft: written from Figma's public REST API docs (including the post-comment endpoint); not yet live-tested end-to-end.