skill-installer

SUSPICIOUS: the stated purpose matches the behavior and the install source is same-org/official GitHub infrastructure, so this is not overtly malicious. However, the skill's main function is transitive installation of other skills from arbitrary GitHub repos, including private repos via user credentials, which creates a meaningful trust-expansion and supply-chain risk.