claude-design-premium-harness

SUSPICIOUS: the skill’s stated purpose matches its local file and design-system behavior, and I found no clear credential theft or exfiltration. However, the installation source is a mutable GitHub branch ZIP from a personal repo with a publisher/repo-owner mismatch and no release verification, which makes the trust chain weaker than the polished documentation suggests.