design-system

SUSPICIOUS: the main design-token extraction purpose is mostly coherent, but the skill routes page data through a third-party remote headless service and includes an adjacent full-site cloning capability that exceeds a narrow token-extraction scope. No clear credential harvesting or overt malware behavior is present, but the external data flow and broad remote tool access make this a medium-risk skill.