frontend-review-security

SUSPICIOUS/medium risk overall: the skill is broadly coherent with its stated purpose, but it is a security-review skill that grants an AI agent pentest-like analysis behavior and runs an unspecified local shell script. There is no clear credential harvesting, exfiltration endpoint, or malicious deception in the visible instructions, so this is not confirmed malware.