frontend-developer

SUSPICIOUS: the core frontend guidance is benign, but the skill adds unrelated companion-skill enumeration and a transitive install path to an unverified/unpinned third-party repo. No direct credential theft or exfiltration is evident, but the purpose-capability mismatch and transitive trust chain make this higher-risk than a normal documentation skill.