megadev-isometric

SUSPICIOUS. The skill’s purpose and capabilities are coherent and mostly documentation-focused, but the install/execution trust is weaker than it should be because it executes an unpinned third-party Docker image from a different publisher than the cited upstream Megadev project. No direct credential harvesting or exfiltration is evident.