design-review

SUSPICIOUS: the core browser-based design-audit purpose is coherent, but the skill’s footprint is broader than necessary because it can bootstrap test frameworks, modify CI/docs/tests, commit repeatedly, and send repo context to external review tooling. I do not see confirmed malicious behavior or credential harvesting, but the eval-based local helper usage and broad write/exec authority make this a medium-risk skill rather than a narrowly scoped benign one.