cli-plugins-skills

SUSPICIOUS: the documented purpose matches the capabilities, and the core CLI install path appears to be an official npm distribution, so this is not confirmed malware. However, the skill is inherently high-risk because it installs and executes other skills/plugins, including from arbitrary URLs/files, creating strong transitive trust and supply-chain exposure beyond a simple management helper.