plugin-maintain

SUSPICIOUS: the skill’s core maintenance capabilities are broadly consistent with its stated purpose, and there is no direct credential harvesting or remote payload execution. Main risks are transitive loading of other skills, execution of unseen repo-local scripts, and fetching arbitrary external content before writing local files, which makes it medium-risk rather than benign.