import-dataset

SUSPICIOUS: the core dataset-import behavior and Calibrate/Hugging Face data flows fit the stated purpose, and no clear credential exfiltration or off-purpose access is shown. However, the skill unnecessarily performs a silent transitive self-update via unpinned `npx skills update`, expanding trust to remote code and hidden instruction changes before execution.