stitch-react-components

SUSPICIOUS. The skill’s overall behavior matches its stated design-conversion purpose, and the flagged `.config` items are false positives. Risk comes from moderate supply-chain trust issues: unpinned npm/npx execution, reliance on a third-party Stitch MCP path, and an unseen local downloader script that fetches arbitrary URLs. No clear credential theft, covert exfiltration, or malicious mismatch is shown, but the install/execution footprint is broad enough to warrant caution.