fabricator

SUSPICIOUS: the skill's purpose broadly matches its capabilities, but it includes load-time shell execution of an unpinned remote CLI and routes core functionality through remotely fetched registry content, including third-party registries. This is more a supply-chain and trust problem than confirmed malware.