skills/alvinindra/figma-mcp-rust/design-token-generation/Socket

design-token-generation

Warn

Audited by Socket on Sep 10, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS. The functional scope fits design-token generation, but the trust model does not: the skill routes powerful Figma read/write capability through a personal third-party MCP/CLI instead of Figma's official MCP service. Main concern is supply-chain and credential/access forwarding risk, not overt malicious behavior in the instructions themselves.

Confidence: 89%Severity: 82%

Audit Metadata

Analyzed At

Sep 10, 2026, 01:18 AM

Package URL

pkg:socket/skills-sh/alvinindra%2Ffigma-mcp-rust%2Fdesign-token-generation%2F@8d27f25bd332559ceb8ee9a902d3d10e0ba804a01b684b679d8ae5180e92d9aa