claude-wireframe-skill

SUSPICIOUS: the stub’s purpose is coherent, but it primarily installs another skill through an unpinned third-party CLI and creates a transitive trust chain to a personal GitHub repo. No direct credential theft or exfiltration is shown here, yet the install path and downstream codebase-scanning behavior make the overall skill medium risk.