architecture

SUSPICIOUS: the skill’s purpose is coherent, but it includes transitive installation of external skills via an unshown local installer script. No direct credential theft or exfiltration is visible, yet the trust chain and unverifiable installer behavior make this a medium-risk AI skill rather than a benign self-contained guide.

Cannot perform a code-specific security assessment due to missing code or dependencies. Provide the actual code, manifest, or package files to enable a concrete source-to-sink analysis, anomaly detection, and risk scoring.