mermaid-architect

SUSPICIOUS: the core behavior fits a diagram-generation skill, but it relies on executing helper scripts from a plugin directory found by scanning $HOME and even suggests installing another plugin. The main risk is transitive/local supply-chain trust rather than clear malicious behavior or credential theft.