design-harness-agent-skill

SUSPICIOUS: the skill’s core behavior is mostly consistent with a markdown-based design workflow, but installation provenance is ambiguous (ara.so branding vs tigerless-labs source), it includes transitive skill installation instructions, and it processes untrusted external content while writing files. No clear credential theft, covert exfiltration, or malicious payload execution is present.