sync-public-skills

SUSPICIOUS/medium risk rather than malicious: the skill’s capabilities mostly match its stated purpose of syncing skills across repos, and its gates are designed to prevent accidental leaks. The main concerns are trust in unverified local PowerShell scripts and the ability to perform autonomous commit/push actions to public and internal remotes, which creates real-world impact if the local scripts or repo configuration are wrong.