magic-portfolio

SUSPICIOUS: The skill’s actions mostly fit a portfolio-template setup guide, and it uses official deployment CLIs/endpoints. The main issue is install trust: it clones from a personal GitHub repo while evidence suggests the real upstream is once-ui-system, creating a provenance mismatch before npm dependency installation. Tokened deploy commands are expected for Vercel, though passing the token as a CLI arg slightly increases exposure.