tech-stack

SUSPICIOUS. The skill’s core stack-guidance purpose is coherent and most flagged file-access findings are benign documentation artifacts, but it expands into user-level MCP setup plus explicit installation of sibling skills and third-party MCP tools. Those behaviors are proportionate to the stated developer-workflow purpose, yet they introduce medium supply-chain and transitive-trust risk rather than clear malicious intent.