audit-typography

SUSPICIOUS. The main audit behavior is benign and well-aligned, but the skill also recommends an optional unpinned install flow that executes the shadcn CLI and pulls project-modifying content from a third-party Fonttrio URL. This is a medium supply-chain risk rather than confirmed malware; no credential theft or covert exfiltration is evident.