api-contract-advanced

SUSPICIOUS: the skill’s purpose and capabilities are coherent for API contract tooling, and Pact-related data flows are proportionate and official. The main risk is the documented npx execution of @asyncapi/generator, because it is unpinned remote code execution and the cited package has recent compromise history; this raises supply-chain risk significantly even without evidence of intentional malicious behavior in the skill itself.