popup-generator

SUSPICIOUS: This deprecated skill is internally coherent as a redirect, but its actual effect is to induce transitive installation of an unreviewed third-party skill from a personal GitHub repo. The install path uses normal npm/skills tooling rather than a raw payload, so this is not confirmed malware, but the trust handoff is a meaningful medium risk.