figma-capture-extension

SUSPICIOUS: the skill’s purpose mostly matches its capabilities, but it relies on an unpinned remote JavaScript download and uses broader browser/page access than minimally necessary. No credential harvesting or clear exfiltration is present, so this is not malware, but install trust and permission scope create medium risk.