kuikly-app-builder

SUSPICIOUS. The skill’s capabilities mostly fit its stated app-builder purpose and its file/device scope is reasonably constrained, but it delegates core behavior to an unpinned `npx @latest` package on every run, creating meaningful supply-chain risk. The hidden acknowledgement wording is a smaller concern: it is manipulative/concealing, though not outright credential theft or malware.