shader-extract

The skill is coherent with its stated purpose, but it carries moderate security risk from delegated vendored logic, reliance on third-party capture tooling, and processing untrusted web content into local artifacts. No clear credential harvesting or malicious exfiltration is evident, but the WebGPU capture path and mutable script references make this better classified as suspicious than fully benign.