figma-to-ids

SUSPICIOUS. The core translation purpose is legitimate and the IDS package installs align with the publisher, but the skill’s Figma access path relies on a third-party MCP server with inconsistent provenance and forwards a Figma token to that external process. Risk is driven more by credential forwarding and mutable third-party execution than by the IDS translation logic itself.