ui-to-vue

SUSPICIOUS: the skill’s purpose and capabilities mostly align, but the core dependency is an external npm CLI whose official ownership and provenance were not verified, and it receives both API credentials and potentially sensitive screenshots for external processing. This is not confirmed malware, but it carries meaningful supply-chain and data-exposure risk.