setup-tangram-remote-tool

SUSPICIOUS. The skill's behavior mostly matches its stated purpose, but it asks the agent/user to install and trust a custom relay package outside official registries, then use it in an authenticated sharing flow. That supply-chain and credential-forwarding pattern is disproportionate enough to rate as high security risk even without direct evidence of malicious intent.