megadev-math

SUSPICIOUS. The skill’s purpose and capabilities are largely coherent and it does not request credentials or exfiltrate data, but it relies on running an unpinned third-party Docker image (`ewrogers/megadev:latest`) that could not be verified as the official upstream Megadev distribution channel. Main risk is supply-chain trust, not confirmed malware.