skill-add

SUSPICIOUS. The core purpose is plausible, and the referenced `repomix` install path appears official, so this is not confirmed malware. But the skill is over-broad for simple skill editing: it chains other skills/subagents, may install tooling on demand, and aggressively ingests untrusted external content while retaining file-write capability, creating meaningful prompt-injection and transitive-trust risk.