frontend-design-pointer

SUSPICIOUS due to transitive trust: the skill mainly tells the agent to install another skill from a remote source. However, the referenced CLI and upstream repository appear legitimate and same-purpose, with no credential harvesting, no hidden execution, and no unrelated data flows, so this is not malicious—best classified as medium-risk trust expansion.