ccc-design

SUSPICIOUS: the core normalization behavior is plausible and locally scoped, but the mandatory dependency on other externally sourced skills creates disproportionate transitive trust and supply-chain risk relative to this skill alone. No direct credential theft or exfiltration is present, so this is not confirmed malicious.

SUSPICIOUS. The typography purpose is benign and internally coherent, with no direct credential access or exfiltration in this file. The main risk is transitive trust: it mandates use of other skills and potentially an npx-based GitHub install path for teach-impeccable without pinning or provenance details, which makes the overall skill chain moderately risky despite a benign stated purpose.

SUSPICIOUS: the core design functionality is benign, but the skill is bundled with broad gstack platform behavior—telemetry, analytics, update checks, contributor logging, browser launching, and optional remote installer/setup steps. Those capabilities are only partly related to design consultation and make the skill's footprint larger than its stated purpose, though there is not enough evidence of confirmed malicious intent.