web-design-guidelines

SUSPICIOUS: the core purpose is coherent, but the skill externalizes its effective rules to an unpinned remote markdown file fetched on every run. This is not confirmed malware and does not show credential theft, yet the mutable remote-instruction design creates medium risk through supply-chain and prompt-injection exposure.