design-shotgun

SUSPICIOUS: the core design-variant workflow is coherent, and the main binaries appear to be same-publisher tooling, not an obvious credential-stealing payload. But the skill’s actual footprint is much broader than its stated design purpose: it reads user/tooling config, writes analytics, can sync artifacts to configured remotes, edits CLAUDE.md, and makes git commits. This looks more like a platform bootstrap/orchestration skill embedded inside a design skill than a narrowly scoped design helper.