community-ff-mcp

SUSPICIOUS: the skill’s capabilities fit its FlutterFlow editing purpose, and data appears intended for the official FlutterFlow API, but setup requires installing and trusting an unofficial community MCP package and handing it a live FlutterFlow API token. This is a proportionate workflow risk rather than clear malware: medium supply-chain and credential-forwarding risk, low evidence of concealment or exfiltration.