emil-design-eng-pointer

SUSPICIOUS. The skill is coherent with its stated purpose as a pointer, and it does not request credentials or route data to odd endpoints. The main risk is that its core function is transitive installation of a third-party upstream skill via an unpinned `npx ... @latest` workflow, which expands trust to external instructions and mutable remote content.