patterns

SUSPICIOUS: the skill’s main capabilities mostly match its stated proxy/template purpose, but it normalizes external delegation through an unpinned npm CLI and explicitly disables approval with `--auto-approve`. Data flow goes to a third-party AI proxy tool rather than staying local, which is disproportionate for a generic patterns skill and creates meaningful autonomy and supply-chain risk without clear credential theft evidence.