engineering

SUSPICIOUS: the skill is mostly a benign engineering guide, but it overreaches by instructing the agent to install and pull another skill via unpinned `npx @latest`. The install path appears official and same-project documented, so this is not confirmed malware, but it is a medium-risk supply-chain and transitive-install trust issue that is somewhat disproportionate to a code-conventions skill.