skill-suggest

SUSPICIOUS: The skill's purpose matches its behavior, and its network/install paths point to the official skills.sh ecosystem, so it is not outright malicious. However, it is a transitive-install skill whose main function is to fetch and install other skills from a public registry using an unpinned CLI, which creates substantial trust and supply-chain risk even without direct credential theft or covert exfiltration.