engineering-advanced-skills

SUSPICIOUS: the index skill is coherent as a catalog of engineering sub-skills, but its trust model is broader than it first appears. The main concern is supply-chain and transitive installation risk: a third-party npm CLI is used to install/load additional skills, and the wider repo documents mutable script-based installers. No direct credential harvesting, exfiltration, or malicious behavior is evident in this top-level file alone.