skills-sh-maintainer

The supplied fragment is installation and rollout documentation with no direct evidence of malware or data theft. It presents a moderate supply-chain risk because npx retrieves and may execute remote tooling, and the PowerShell example can distribute that content globally or across many repositories. Review and pin the CLI/source versions and inspect installed skill files before execution, especially the referenced synchronization script.