frontend-design-guidelines

SUSPICIOUS: the core frontend-design behavior is benign, and the shadcn install path is official, but the skill’s footprint is broadened by embedded telemetry, local config reads/writes, a config-controlled external POST endpoint, and transitive skill invocation. This looks more like an over-scoped developer skill than confirmed malware, with medium security risk driven by telemetry/data-flow and mutable external execution.