superdesign

SUSPICIOUS. The skill is broadly aligned with a hosted design-assistant purpose, and the CLI/package provenance appears same-org and officially documented. However, it has a substantial footprint: repeated unpinned auto-executed npm installs, extensive repo code ingestion, uploads of local assets/context to a third-party service, and external-content processing. This is not fundamentally incompatible with the stated purpose, but the combination makes it medium risk and worth treating cautiously.