octocode-skills

SUSPICIOUS: the skill’s purpose is coherent for a meta-skill, but its footprint is broad and includes remote discovery/install/sync plus related-skill delegation. The excerpt shows approval language and local review gates, which helps, but the actual provenance and transitive trust controls are not fully visible here, so the main risk is supply-chain and skill-to-skill trust expansion rather than confirmed malicious behavior.