md-render

SUSPICIOUS: the skill’s purpose and local file/config access are coherent for Markdown preview, and the flagged ~/.config usage is benign. However, it relies on an unspecified external md-render CLI whose publisher and installation path are not verifiable from the skill, creating disproportionate supply-chain risk even without evidence of active exfiltration.