product-showcase

SUSPICIOUS. The skill's overall purpose is coherent, and most deployment guidance points to official vendors, but it relies on at least one unverifiable local CLI (`capture-screenshots`) and forwards raw app credentials to it via `--auth user:password`. Under the mandatory override, an unverifiable binary that receives credentials is high risk even without confirmed malicious behavior.