processon-diagram-generator

SUSPICIOUS: the core diagramming/API behavior is broadly consistent with the stated purpose and uses apparently official ProcessOn domains, but the skill adds unnecessary trust-expanding behavior through mandatory remote version checks and a transitive, unpinned GitHub-based npx self-update path. Risk is driven more by supply-chain and update-channel design than by overt credential theft or mismatched capabilities.