design-judge-skills

SUSPICIOUS. The skill’s stated purpose and runtime behaviors are mostly coherent for design-award research and submission support, with no clear credential harvesting or malicious exfiltration. The main concern is transitive trust: installation relies on a third-party skills CLI pulling from a personal, mutable GitHub repo rather than a pinned, same-org, verifiable release channel; optional Browserless also adds third-party data routing for scraping. This is not confirmed malware, but it carries meaningful supply-chain and trust risk.