wireframe

SUSPICIOUS. The skill’s stated purpose and capabilities are mostly aligned: it acts as a wireframing dispatcher and does not request credentials or route data to off-platform endpoints. The main concern is transitive trust: it relies on loading a family of other skills and is distributed through a personal GitHub repo via an external Skills CLI, which broadens the attack surface without strong release verification. This is not confirmed malware, but it carries moderate security risk from supply-chain and skill-chaining behavior.