drawio

SUSPICIOUS: the skill’s core diagramming purpose is legitimate and mostly aligned with its capabilities, but its setup relies on transitive installation of external skill bundles and several third-party tools. No clear credential theft or exfiltration is shown, so this is not malicious; the main concern is install-chain trust and inconsistent/outdated upstream install guidance.