bmod-method

SUSPICIOUS: the skill is mostly a pointer that instructs the agent to install another skill, so its footprint is dominated by transitive trust rather than local functionality. The install command appears official and publisher-consistent, with no credential theft or hidden execution, but importing an external skill through `npx skills add` is still a meaningful medium risk.