megadev-effects

SUSPICIOUS. The skill’s functional purpose is coherent and mostly documentation-like, but its main execution path relies on an unpinned Docker image from a different publisher than the referenced Megadev source project. There is no clear evidence of credential theft or malicious exfiltration, but the supply-chain trust mismatch is significant enough to make the skill risky.