plugin-updater

SUSPICIOUS: The stated purpose matches plugin management, but the skill's trust model is weak because it executes third-party cached scripts by discovery rather than verified provenance. No clear credential theft or exfiltration is shown, yet the combination of auto-updating and arbitrary local script execution from plugin cache makes this a medium-high supply-chain risk.