ultimate-ui

SUSPICIOUS: the core UI guidance is benign, but the companion-skill behavior is out of scope and introduces medium risk through transitive installation and runtime `npx` execution of third-party skill content. No direct malware or credential theft is evident, but the install flow expands trust beyond what a UI design skill needs.