figjam-plugin
Build FigJam Plugin Features
FigJam plugin changes can fail when main-thread and UI APIs are mixed. This skill guides Claude, Codex, and Claude Code through the project structure, build flow, and import workflow.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "figjam-plugin" from https://skillstore.io/skills/7nohe-figjam-plugin.md and its manifest at https://skillstore.io/api/skills/7nohe-figjam-plugin/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "figjam-plugin". I need to add a shape rendering feature to the plugin.
Expected outcome:
The response separates canvas rendering work into code.ts, UI state into ui.ts, and validation checks before drawing.
Using "figjam-plugin". The plugin build succeeds, but Figma does not show the latest behavior.
Expected outcome:
The response recommends rebuilding the plugin package, confirming the imported manifest path, and checking the correct Figma development console.
Using "figjam-plugin". A WebSocket message reaches the UI but nothing appears on the canvas.
Expected outcome:
The response traces the UI postMessage handoff, main-thread handler, IR validation, and final figma API rendering step.
Security Audit
SafeThe static findings are false positives caused by Markdown backticks and code fences in SKILL.md. The only command shown is a fixed local build command, and no prompt injection, exfiltration intent, or malicious instruction was found.
Risk Factors
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/7nohe-figjam-plugin/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/7nohe-figjam-plugin?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/7nohe-figjam-plugin?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/7nohe-figjam-plugin/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/7nohe-figjam-plugin.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
7nohe. (2026). figjam-plugin security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/7nohe-figjam-plugin/audits/6BibTeX citation
@techreport{7nohe-7nohe-figjam-plugin-2026,
author = {7nohe},
title = {figjam-plugin security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/7nohe-figjam-plugin/audits/6},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "figjam-plugin security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
- name: "7nohe"
date-released: "2026-07-04"
url: "https://skillstore.io/skills/7nohe-figjam-plugin/audits/6"
identifiers:
- type: other
value: "skillstore:7nohe-figjam-plugin:audit:6"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: HighWhat You Can Build
Add Canvas Rendering
Use the skill to place rendering changes in code.ts and keep browser APIs out of the main thread.
Repair UI Messaging
Use the skill to trace WebSocket, postMessage, and canvas communication when plugin data does not arrive.
Prepare Local Plugin Testing
Use the skill to build the package and import the manifest through Figma Desktop development tools.
Try These Prompts
I need to change a FigJam plugin feature. Tell me whether the change belongs in code.ts or ui.ts, and explain why.
Review this FigJam plugin build error. Identify the likely thread boundary issue and suggest the smallest fix.
Trace the CLI to UI to main-thread message flow for this plugin bug. List the checks I should run in order.
Design an implementation plan for a new FigJam rendering feature. Separate UI work, message passing, validation, and canvas rendering.
Best Practices
- Keep browser APIs in ui.ts and FigJam canvas APIs in code.ts.
- Run the documented build before importing the manifest in Figma Desktop.
- Check UI and main-thread consoles separately when debugging.
Avoid
- Do not call window, document, fetch, or WebSocket from code.ts.
- Do not treat WebSocket delivery as proof that canvas rendering succeeded.
- Do not import a stale manifest after changing plugin package files.