megadev-multiplayer

SUSPICIOUS. The skill’s stated purpose is coherent and the documentation is otherwise benign, but it relies on executing a mutable, unverified Docker image from a personal namespace that is not clearly tied to the publisher. There is no credential harvesting or exfiltration behavior shown, yet the external container execution over mounted local files makes install trust disproportionate enough to raise medium-high supply-chain concern.