api-to-agent-cli

SUSPICIOUS: the skill’s purpose and actions mostly align with a todo CLI, and the documented commands are not themselves malicious. However, the core `hello-cli` dependency is unverified and the service endpoint is undisclosed, so credential and data flows cannot be validated; this drives a high supply-chain/security-risk classification rather than confirmed malware.