design-to-shadcn

SUSPICIOUS. The core behavior fits a design-skinning skill, and most commands are legitimate workflow instructions. Risk comes from transitive skill loading and especially the explicit use of third-party component registries, which broadens supply-chain trust and may forward registry credentials to external services. No confirmed malware or credential-stealing behavior is present.