composing-react-native-application

SUSPICIOUS: the skill's purpose is coherent and there is no sign of credential theft or hidden exfiltration, but it expands trust by instructing the agent to install multiple additional skills from remote GitHub publishers, including personal repos, without version pinning. Main risk is transitive remote instruction loading rather than malware behavior.