user-interface

SUSPICIOUS: the skill’s stated UI-guidance purpose is mostly coherent, but it introduces unnecessary transitive installation risk by directing agents to fetch another skill from a publisher not clearly tied to the upstream pmndrs project. No credential theft or exfiltration is present here, so this is not confirmed malware, but the remote skill-install path makes it medium-high security risk.