hz-metavrx-layout-sdk

SUSPICIOUS. The skill’s purpose and capabilities are coherent as a framework/setup guide, with no credential access, exfiltration, stealth, or autonomous actions. However, install trust is weakened because the React Native package could not be verified publicly, its scope does not clearly match known Meta package naming, and the Compose SDK is distributed via an out-of-band zip/local Maven repo. This looks like a legitimate internal/partner documentation skill with medium supply-chain risk rather than malware.