ui-ux-pro-max

SUSPICIOUS: the stated purpose is benign design assistance, but the skill asks the agent/user to execute an unverified external CLI without provided provenance linking the npm package to the skill publisher. No clear credential theft or exfiltration is shown, so this is mainly a supply-chain and install-trust concern rather than confirmed malware.