typoshift

SUSPICIOUS. The skill's purpose and capabilities are mostly coherent for keyboard-layout reconstruction, and it avoids obvious credential access or exfiltration. The main risk is the on-demand execution of unpinned code from a personal GitHub repository via uvx/pipx, which is disproportionate to a text-reconstruction helper and creates a meaningful supply-chain hazard.