dependency-mapping

SUSPICIOUS: The skill's purpose is coherent with dependency analysis and migration, and its npm/package actions are proportionate. Risk comes from transitive skill installation and executing unshown toolkit/setup code via unpinned tooling, which makes the install/execute chain less trustworthy even though there is no sign of credential harvesting or off-purpose data exfiltration.