slideshow

SUSPICIOUS. The core slideshow functionality is coherent and mostly proportionate, but the skill unnecessarily instructs the agent to silently run an unpinned `npx` update and refresh additional dependent skills. This is not confirmed malware because the command appears to use the project’s official npm/Repo ecosystem, but it introduces medium supply-chain and transitive-trust risk that does not need to be hidden from the user.