guided-product-demo

SUSPICIOUS: the skill’s purpose is coherent, and its requested data mostly matches a demo-generation workflow, but the install/runtime trust is inconsistent. The main concern is that the Helios npm packages and npx path do not clearly align with the currently documented official Helios distribution, creating medium supply-chain risk; no direct credential theft or exfiltration behavior is evident from the skill text.