design-debt-audit

SUSPICIOUS: the stub’s stated purpose is coherent, and the local shell checks are benign documentation, but its main function is to install a separate remote skill via a third-party CLI and plugin path. The risk is transitive trust and mutable remote content rather than confirmed malicious behavior.