dsh-plugin-upgrade

SUSPICIOUS. The skill’s purpose is coherent, and its data flow is mostly local and proportionate to plugin migration. However, it centers on executing a non-official third-party CLI with broad access to source trees, dependency installation, and runtime verification; that supply-chain trust gap makes the skill medium-high risk even without clear exfiltration or malicious behavior.