trunative-expo

SUSPICIOUS: The skill’s stated purpose and file access are coherent for Expo UI design/review, and there is no evidence of credential theft or exfiltration. The main issue is install/execution trust: it instructs unpinned `npx trunative` execution, but the package and publisher could not be verified from the evidence, so the remote code path is disproportionally risky for an otherwise documentation-style skill.