figma-ui-mcp-bridge

SUSPICIOUS. The core capability is coherent for a Figma bridge, and data stays on localhost during normal use, but trust is weakened by third-party code installation, transitive MCP loading, and especially the manually imported plugin ZIP from a raw GitHub URL. This looks more like a legitimate but higher-trust workflow integration than malware; the main concern is supply-chain/install trust, not clear credential theft or exfiltration.