scout

SUSPICIOUS. The skill’s core purpose is coherent, but it is inherently high-risk because it installs other skills and can pull from third-party repos, extending trust beyond the reviewed skill. The vskill project appears legitimate and same-org documented, so this is not confirmed malware; the main concern is transitive supply-chain risk plus reduced user review through force/yes install guidance.