design-consultation

SUSPICIOUS. The skill's core behavior mostly fits a design-consultation workflow, including local project reads, optional competitive research, preview generation, and DESIGN.md output. The main concern is scope and trust: it pulls in a broad same-org gstack runtime with many helper binaries, cross-session state, and telemetry/logging that exceed what a minimal design skill needs. I do not see confirmed malware, credential harvesting, covert exfiltration, or dangerous pre-execution directives, but the operational footprint is large enough to warrant caution.