xhs-static-cards

SUSPICIOUS: The core behavior is coherent for a local static-card generation skill and shows no clear credential theft or exfiltration, but it carries meaningful supply-chain risk because it instructs the agent to install multiple third-party skills and execute project code, including an unverified primary skill source. Risk is driven by transitive trust and remote installs, not by obviously malicious behavior.