office-install

SUSPICIOUS: the skill’s capabilities mostly match its stated purpose as an environment bootstrapper, but it carries medium risk from remote installers, mutable branch/archive updates, a third-party LibreOffice mirror, and especially transitive installation of other skills via `npx skills add`. Data flows are mostly local and to official endpoints, with no clear credential harvesting or exfiltration.