superskills-upgrade

SUSPICIOUS: the skill is purpose-aligned, but upgrading by pulling remote code and immediately rerunning `./setup` creates meaningful supply-chain risk. The lack of origin verification increases concern, though there is no clear credential theft, stealth, or unrelated capability expansion.