infrastructure-claude-code-game-workflow

SUSPICIOUS: The skill’s stated purpose mostly matches its workflow/configuration footprint, and the hook examples are coherent and not covert. The main risk is install/execution trust: it tells users to run multiple unpinned npm-based MCP servers and forwards a GitHub token into one downloaded CLI, including a third-party Playwright MCP package. This is not confirmed malware, but it is a medium-high supply-chain and credential-forwarding risk for a workflow guide.