@tank/frontend-craft

SUSPICIOUS due to supply-chain breadth, not overtly malicious. The skill's purpose matches frontend component discovery, but it normalizes pulling code from many third-party registries via an unpinned CLI and custom search scripts, which is broader than a narrowly scoped design guide. No credential collection or obvious exfiltration was found, so this is best classified as medium security risk rather than malware.