diagram-design-editorial

SUSPICIOUS: the skill’s stated purpose is coherent, and there is no clear credential theft or malicious exfiltration. Risk comes from third-party/transitive installation paths from a personal GitHub repo, mutable install sources, and onboarding that fetches arbitrary external websites while allowing local file writes.