UI Prototype Generator

从参考图片或描述生成交互式原型。默认输出 HTML 格式，仅在用户明确要求时使用 Figma。支持 (1) 用于网页预览和测试的 HTML 原型，(2) 通过 API 生成 Figma 设计文件用于设计交接和协作，(3) 基于组件架构的可复用 UI 元素，(4) 响应式布局和交互状态，(5) 基于反馈的快速迭代。

This skill appears to do what it says: generate HTML prototypes by default and call the Figma API only when asked. Before installing or using it, review these points: (1) Never paste your Figma Personal Access Token into a chat with the agent unless you explicitly trust that channel — prefer creating the auth-profiles.json file in the path the skill documents (or set the env var) so the agent reads the token from disk rather than you typing it into conversation. (2) Inspect scripts/scripts/figma_generator.py and scripts/html_generator.py (they are included) to confirm API calls go only to api.figma.com and that there is no hidden logging/exfiltration. (3) Limit the Figma token scope to the minimum needed, and rotate/revoke it after testing. (4) When running any included script locally, run it in a sandbox or with least privileges; avoid running unknown scripts as root. (5) The SKILL.md is somewhat vague about how tokens are 'securely saved' — if you plan to use Figma output, set up auth-profiles.json yourself in the documented location rather than pasting credentials into the assistant. If you want higher assurance, ask the maintainer for a security walkthrough or review the full python scripts before enabling Figma integrations.

Type: OpenClaw Skill Name: ui-prototype-generator Version: 1.0.0 The ui-prototype-generator skill bundle is a legitimate tool for generating HTML and Figma prototypes. The core logic in scripts/html_generator.py and scripts/figma_generator.py follows the stated purpose, using standard templates and API interactions. While figma_generator.py accesses sensitive Figma API tokens from auth-profiles.json, this behavior is documented and necessary for the tool's functionality, with no evidence of exfiltration to unauthorized endpoints or malicious prompt injection in SKILL.md.