tools-ui

SUSPICIOUS: The core UI-component purpose is mostly coherent, but the skill unnecessarily expands trust by directing installation of other skills, especially `belt-sh/cli`, which is outside the publishing org. No direct credential theft, exfiltration, or hidden execution appears here; risk is mainly transitive trust and remote install surface rather than confirmed malware.