threenix-add-fireworks

SUSPICIOUS: the skill’s purpose is coherent, but it pulls authoritative code from an external MCP server and instructs the agent to write it verbatim and install returned dependencies. That is proportionate to a component-integration skill, yet still a meaningful supply-chain risk because remote content provenance and review are delegated to the server.