prd

SUSPICIOUS: the skill’s core purpose is coherent—loading local PRDs, specs, and Figma context—but its installation trust is weaker than it should be because it depends on an unpinned CLI installed directly from a personal GitHub repo. The data flows and requested access are otherwise proportionate, with no clear credential theft or exfiltration behavior. Main concerns are supply-chain trust, undeclared reliance on another skill, and the mismatch between required CLI execution and the declared tool permissions.