taste-skill

Suspicious. The visible stub is not overtly malicious and does not request credentials, but its primary function is to install a separate third-party skill from a personal GitHub repo through a transitive trust chain. That makes the footprint broader than a simple design-guidance skill and creates medium supply-chain risk.