tech-design-writer

SUSPICIOUS. The skill’s purpose is coherent, but it routes sensitive user documents and an auth token through an undocumented third-party bridge over plain HTTP instead of an official documented OpenCode API. That makes the data flow and trust model disproportionate for a document-writing skill, even though there is no confirmed malware or true command injection.