figma-cracked-desktop

SUSPICIOUS. The skill’s behavior mostly matches its stated purpose, and there is no clear credential theft or exfiltration flow, but the install path is high-risk: it directs users to clone and build an unofficial Figma client from an unrelated, currently unverifiable GitHub repository. That publisher/source mismatch and inability to verify the upstream project make the supply-chain footprint disproportionate to a simple desktop-client helper skill.