moai-workflow-project

SUSPICIOUS: The skill’s overall purpose is coherent, and its external endpoints appear mostly legitimate, but its broad command scopes (`npm/npx/pip/uv` wildcard Bash) give it more execution power than a docs/workflow skill strictly needs. Main risks are supply-chain exposure from arbitrary package installs and indirect prompt injection from untrusted web content combined with write/exec capabilities; there is no clear evidence of credential theft or malicious exfiltration.