web-design-guidelines

SUSPICIOUS: purpose is coherent, but the skill outsources its effective rules to a mutable remote markdown file on every run. That is a real supply-chain and prompt-injection risk, though there is no evidence of credential theft, malware, or disproportionate permissions.