soia-dev-design-explorer

SUSPICIOUS: the stated purpose is coherent for a design workflow wrapper, but the actual footprint is broader than necessary because it installs another skill transitively, grants wildcard permissions, and executes dependent skill scripts from local skill directories. No direct credential theft or exfiltration is visible in this fragment, but trust is delegated to an unreviewed dependency, so the overall risk is high enough to avoid a benign classification.