vue-design-system

SUSPICIOUS: the stated Vue design-routing purpose broadly matches the capabilities, but the trust footprint is larger than advertised because it chains into other skills and executes npm-fetched MCP servers at runtime. The biggest concern is the inconsistent, unofficial Penpot MCP path receiving an access token, plus mutable npx/@latest execution; this looks more like elevated supply-chain and trust risk than confirmed malware.