paper-ds-land

SUSPICIOUS. The skill’s purpose and capabilities are mostly coherent for design-system adoption work, and it does not show credential theft, stealth, or clear exfiltration behavior. Risk comes mainly from incomplete install/provenance details, implied dependence on external Paper/MCP tooling with only an unpinned third-party npm example found, and transitive trust in another skill.