sync-skills-lock

SUSPICIOUS. The skill’s behavior mostly matches its stated purpose and includes many fail-closed guards, but it still performs transitive remote skill installation through an npm-delivered CLI and can execute a repository-owned checker script. Those capabilities are proportionate for sync/update automation yet materially raise trust and supply-chain risk beyond a simple lockfile updater.