ui-ux-pro-max-pointer

SUSPICIOUS: internally coherent as a pointer skill, but its primary function is transitive installation of a third-party upstream skill from a different publisher. No direct credential theft or exfiltration is present, so this is not malicious; the main risk is delegated trust and supply-chain exposure.