dtcg-tokens

SUSPICIOUS: the stated purpose broadly matches a design-token generation skill, and there is no clear credential harvesting or exfiltration path in the visible text. But the skill delegates nearly everything to opaque `mise` tasks and ambiguous `skill-factory` commands, with possible auto-installed tooling outside the visible scope, so trust and execution boundaries are not fully verifiable from the skill alone.