create-railcode-app

SUSPICIOUS. The overall skill is mostly coherent with its stated purpose as an official Railcode app-building guide, and its installs/downloads appear to come from vendor-controlled npm/GitHub sources. However, it still has meaningful security risk from transitive skill installation, mutable latest/branch-based supply-chain steps, a hidden feedback command that sends metadata to Railcode backend, and broad real-world deployment capabilities. This looks like a legitimate but high-trust vendor workflow skill, not confirmed malware.