shipwright-pipeline

SUSPICIOUS: The stated app-building purpose is plausible, but the skill outsources its core behavior to an external personal-account package not clearly affiliated with the listed publisher. This creates meaningful supply-chain and credential-forwarding risk, though there is no direct evidence of overtly malicious or exfiltration-specific behavior in the skill text itself.