unit-3-hyprland-nier-rice

SUSPICIOUS: the skill’s functionality matches its stated desktop-theming purpose, and there is no clear credential theft or off-purpose data exfiltration. The main issue is supply-chain trust: it asks the agent/user to run an unpinned remote installer and execute a script from a personal GitHub repo whose ownership does not clearly match the skill publisher.