generative-ui

SUSPICIOUS: the core json-render guidance is internally consistent and mostly benign, but the skill expands into unpinned third-party component ingestion (`dither-kit` via shadcn registry) and transitive skill installation/use. No clear credential theft or malicious exfiltration is present, yet the remote mutable supply-chain footprint is broader than necessary for a documentation-style skill.