awesome-design

SUSPICIOUS: the skill’s purpose as a design-skill directory matches its content, but it directly instructs users to install many unpinned third-party skills from unrelated GitHub repos and asserts they are safe without showing verification. No direct credential theft, exfiltration, or malicious payload execution is present in the provided skill, so this is not malware; the main issue is medium-high supply-chain and transitive trust risk.