show-math

SUSPICIOUS. The purpose is coherent, but the primary install/exec path asks the agent to run an unpinned `npx` package whose ownership and existence were not clearly verifiable from the provided evidence. That makes the remote execution trust disproportionate to a simple math-rendering skill, even though there is no clear credential theft or exfiltration behavior.