opencode-mcp-figma-auth

SUSPICIOUS. The capability mostly matches the stated purpose—obtaining Figma MCP auth and storing it locally—but the trust model is weaker than ideal because users must install and run a personal third-party project to obtain credentials intended for Figma/OpenCode integration. Data flows appear proportionate and directed to Figma's official MCP endpoint, with no clear exfiltration or covert behavior, so this is not confirmed malware; it is a medium-risk third-party auth helper with supply-chain and credential-handling concerns.