cali-coding-starhtml

SUSPICIOUS. The skill’s purpose is coherent, and most references align with official StarHTML/StarUI docs, but the checker installation path is a disproportionate supply-chain risk: an unverified executable script is fetched from a personal raw GitHub URL, written to PATH, and later allowed to self-update from mutable remote code. No credential theft or malicious data exfiltration is evident, but the install trust model is weak enough to warrant a high security-risk classification.