synthetic-users

SUSPICIOUS: the skill's main research-writing behavior is locally scoped and coherent, but it also instructs transitive installation of more skills from a personal GitHub repository via an unpinned `npx` CLI flow. There is no direct credential harvesting or exfiltration here, yet the install-and-expand trust chain is disproportionate to a synthetic persona guide and raises meaningful supply-chain risk.