melech-sync-skills

SUSPICIOUS. The skill is coherent with its stated purpose as a sync meta-skill, and it uses Vercel's official Skills CLI path, but its purpose is inherently to install other skills from a personal GitHub repo with `--all`. That transitive trust expansion, plus unpinned `npx` execution and global mutation of agent skill directories, makes the footprint higher risk than a normal documentation or helper skill. I do not see confirmed credential theft or covert exfiltration.