awwwards-setup

SUSPICIOUS. The skill is purpose-aligned and uses documented same-project install paths, but it asks the agent to register and execute third-party npm packages with latest-by-default npx/npm commands and optional global installs. This is a moderate supply-chain and transitive-trust risk rather than clear malicious behavior; no credential harvesting or unrelated data exfiltration is evident.