figma-make-extractor

SUSPICIOUS: The skill’s behavior mostly matches its stated extraction purpose and it does not request credentials or route data off-host, but the trust chain is weak because ara.so republishes a third-party personal GitHub tool whose run-all.sh auto-installs dependencies. Main risk is supply-chain/install trust, not confirmed malware or exfiltration.