app-tutorial-manual-generator

SUSPICIOUS. The skill’s capabilities broadly match its purpose, but it auto-installs and executes multiple external MCP tools, including an unpinned `npx @latest` package and a DevStudio MCP dependency whose provenance is not established in the provided evidence. Browser/desktop control and recording are proportionate for tutorial generation, yet the combination of broad capture access and auto-provisioned tooling makes this a medium-high security risk rather than benign.