generate-mockups

SUSPICIOUS. The core capability fits the stated purpose, and the skill does not seek credentials or exfiltrate data, but it does expand trust by invoking other skills and by using an unpinned `npx`-fetched external CLI for advisory content. This is a coherent mockup skill with moderate supply-chain and transitive-trust risk rather than malware.