openpencil-design

SUSPICIOUS. The skill’s capabilities largely match its stated design-automation purpose, and there is no direct credential harvesting or exfiltration flow in the skill text. The main issue is install/execution trust: the skill relies on a powerful external CLI/MCP with inconsistent publisher provenance and at least one official remote-script installer path lacking clear verification, which is disproportionate enough to warrant caution.