design-negotiation

SUSPICIOUS: the visible stub is not directly malicious, but its core purpose is to install a separate third-party skill through an npx-managed trust chain. The local checks are benign and no credential harvesting is visible here, yet the transitive installation behavior makes the actual footprint unverifiable from this file alone.