unified-workflow

SUSPICIOUS: mostly a benign workflow guide, but it crosses into higher risk by instructing the agent to install third-party external templates via unpinned `npx ...@latest`, creating transitive trust beyond the stated workflow methodology. No direct credential theft or malicious exfiltration is evident, so this is better classified as supply-chain/transitive-trust risk rather than malware.