content-security-policy-generator

SUSPICIOUS: The stated purpose is benign, but the skill is overly generic and grants unnecessarily broad Bash(npm:*) execution without a clear CSP-specific need or documented trusted dependency. No direct malware, credential theft, or exfiltration is shown, but the shell/package-install scope makes the skill medium risk and internally disproportionate to its purpose.