product-skills

SUSPICIOUS: the skill’s stated purpose is benign and mostly aligned with local product/UX workflows, but its recommended installation relies on an unpinned third-party npm CLI from a different publisher, creating medium supply-chain and transitive-trust risk. No direct credential harvesting or malicious data flow is evident in the provided content.