ccc-design

This appears to be a legitimate scaffolding/setup script with no direct indicators of intentional malware (no exfiltration, backdoor logic, or obfuscated execution). However, its supply-chain integrity is meaningfully weakened by (1) blind extraction of a local tarball into `src/` without checksum/signature verification (allowing arbitrary code injection into the app), and (2) broad dependency installation from public registries with limited version pinning (increasing exposure to compromised or unexpected upstream packages/install-script execution). The main concern is supply-chain tampering rather than overt malicious behavior in the script.

SUSPICIOUS: the skill’s own content is benign design guidance, but it mandates transitive use of other skills, including a likely third-party teach-impeccable dependency with ambiguous/unpinned provenance. No direct malware or exfiltration is present in this skill, yet the external skill trust chain makes the overall footprint riskier than its simple UI-color purpose suggests.

SUSPICIOUS. The core purpose is coherent for a frontend design skill, and no direct credential theft or exfiltration is present. The main concern is transitive trust: the skill forces installation/use of other third-party skills from an external repo, creating a broader unreviewed instruction chain than its stated purpose requires.

SUSPICIOUS: The skill’s stated purpose is benign and its own footprint is minimal, but it depends on other skills by name, including one same-org-looking reference and one apparently third-party/unverified reference. No direct malware or credential theft is evident here; the main concern is transitive skill trust and lack of pinning/verification.