sgdk-shmup

SUSPICIOUS. The skill’s game-development purpose is coherent and it does not request credentials or exfiltrate data, but its install path relies on an unverified third-party Docker image with a mutable latest tag instead of the official SGDK source. That supply-chain issue is disproportionate enough to raise the overall risk despite otherwise benign documentation content.