figma-variables-tokens-generator

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs the agent to run "npx skills add Shanmus4/figma-variables-tokens-generator" (upstream: https://github.com/Shanmus4/figma-variables-tokens-generator), which will fetch and install external code at runtime and then execute that package as the skill, so the agent would execute remote code it depends on.