sveltia-cms

SUSPICIOUS: the skill’s overall purpose and capabilities are mostly coherent for a CMS integration guide, and there is no clear malware behavior. However, trust is weakened by reliance on an externally hosted auth helper repo outside the obvious publisher org, forwarding GitHub OAuth secrets into that worker, and widespread unpinned supply-chain examples (especially unpkg CDN loading). This is better classified as a medium-risk vulnerable/suspicious skill rather than benign or malicious.