upgrading-emdash

SUSPICIOUS: the stated purpose is coherent, but the trust chain is not fully verifiable because the skill's core action is to run an unpinned `npx upgrade-emdash@latest` package that I could not confirm as an official EmDash-maintained updater. There is no clear credential harvesting or exfiltration behavior, so this looks more like install-trust and supply-chain risk than confirmed malware.