omni-github-skills

SUSPICIOUS: the skill's purpose and capabilities mostly align, but its main function is to fetch untrusted third-party agent skills from GitHub and install them into live agent directories. That transitive installation model and prompt-injection exposure make it high risk even without direct evidence of malware or credential theft in this snippet.