product-skills

SUSPICIOUS: The skill’s stated purpose is coherent, and the visible content is mostly a benign index for product-related sub-skills and local Python tools. However, it instructs installation through an unrelated third-party CLI, creating supply-chain and transitive-trust risk; this is the main concern rather than confirmed malicious behavior.