sdlc-ui-visual

SUSPICIOUS. The skill’s capabilities mostly fit its stated UI-visual-restoration purpose, and there is no clear credential theft or covert exfiltration behavior. Main concerns are dependency trust: an unpinned Pillow install and a Figma MCP/toolchain whose naming and methods do not align with Figma’s official documented MCP interface, making that external integration harder to verify.