ra-qm-skills

SUSPICIOUS: the visible skill purpose is coherent, but the recommended Codex installation path relies on a third-party CLI unrelated to the skill author and performs transitive skill installation from a remote repo. No direct credential theft or exfiltration is evident in the provided fragment, so this is better classified as medium supply-chain/trust risk rather than malware.