example-harness

SUSPICIOUS. The skill's purpose and capabilities mostly align, but its install and execution path relies on mutable remote content: an unpinned raw GitHub skill file plus npx execution of @latest packages. That is a meaningful supply-chain risk for an AI agent skill, though there is no clear evidence of credential theft, covert exfiltration, or malicious intent in the provided content.