autosync-ic-skills

SUSPICIOUS. The skill is internally coherent and appears to use an official DFINITY/ICP skills domain for its downloads, so it does not show clear malicious intent or credential harvesting. However, it installs a SessionStart hook that repeatedly executes a remotely sourced, mutable script and transitive remote skill updates without version pinning or checksums, creating a medium trust and supply-chain risk.