install-skill

SUSPICIOUS: the skill's behavior matches its stated purpose, and data flows stay largely within GitHub plus local repo tooling, so this is not confirmed malware. However, it imports untrusted third-party skill content into the repo and can auto-merge it, creating meaningful supply-chain and autonomy risk even with scanning and disabled-by-default safeguards.