nuxt

SUSPICIOUS: the skill’s stated purpose as Nuxt guidance is mostly coherent, but it asks the agent to install another skill from a personal-domain URL, creating a transitive trust chain that is broader than a simple documentation skill. No credential harvesting or clear exfiltration is shown, so this is not confirmed malware, but the install path and skill-to-skill loading make it medium risk.