Skill Manager

SUSPICIOUS: The skill's stated purpose is coherent, but its primary mechanism is unpinned `npx` execution of a package that installs other skills, creating significant supply-chain and transitive-trust risk. It does not show direct credential theft or explicit exfiltration, but the install/update behavior is high-impact and broader than a simple local lifecycle tracker.