iblai-landing

SUSPICIOUS. The core purpose is coherent for a landing-page builder, and there is no sign of credential theft or exfiltration. Risk comes from execution trust: unpinned npx installs, a required transitive /iblai-test step, and especially pulling code from the third-party @shadcn-space community registry. This is a medium/high supply-chain risk skill, not confirmed malware.