21st-dev-components

SUSPICIOUS. The skill’s purpose is coherent and there is no clear credential theft or hidden exfiltration, but it combines external site crawling, remote community-code retrieval, dependency installation, and automatic repo modification. Main risk is indirect prompt injection and supply-chain exposure rather than confirmed malware.