figma-code-connect-components

SUSPICIOUS. The skill is mostly a pointer that delegates real behavior to an upstream install, so its footprint is not directly malicious but it adds transitive trust risk and provenance ambiguity. Because it asks the agent/user to install another skill bundle without exact pinned instructions, it is riskier than a normal documentation entry even though the referenced ecosystem appears Figma-related.