measure

SUSPICIOUS. The skill’s purpose and requested capabilities are largely coherent for typography validation, and there is no clear credential theft or exfiltration flow. However, its core workflow depends on running an unverifiable external CLI (measure-cjk) fetched from npm without confirmed publisher/source provenance, which makes the install/execution trust disproportionally risky for an agent skill.