awesome-design-md

SUSPICIOUS. The skill is purpose-aligned and uses the official npm ecosystem rather than obvious malicious delivery, but it asks the agent to execute an unpinned `@latest` package with auto-confirmation. Evidence suggests the commands are legitimate for this design-template workflow, yet the exact same-org relationship between the executed npm package and the cited VoltAgent upstream is not fully established, so the installer trust is only partially verifiable.