arch-viz

SUSPICIOUS. The skill's capabilities largely match its stated purpose: it scans local repos and writes architecture artifacts locally, with no obvious credential harvesting or unrelated data exfiltration. However, its core functionality depends on building and globally installing arch-viz from an unpublished personal GitHub repository rather than an official registry or verifiable release channel. That unverifiable CLI install path is disproportionate enough to make the skill high-risk from a supply-chain perspective, even though the data flow itself appears local and purpose-aligned.