megadev-graphics

SUSPICIOUS: the skill’s graphics guidance is coherent, but its example build path depends on an unpinned third-party Docker image that does not match the cited upstream Megadev publisher. No direct credential theft or exfiltration is shown, and the scanner’s command-injection hit is documentation-only, but install trust is weak enough to make the overall skill medium-high risk.