devup-ui

SUSPICIOUS: The core Devup UI package installs and configuration guidance are coherent with the stated purpose and appear to match official docs, so there is no sign of credential theft or hidden exfiltration. The main risk is trust-chain related: the skill is distributed from an unrelated third-party repo and instructs transitive installation via the skills CLI, with an additional unverifiable local helper script mentioned but not provided.