track-job-changes

SUSPICIOUS: the main job-change capability is broadly aligned with the stated purpose, and the install source appears to be Cargo's official npm package. However, the skill expands scope by routing user auth and contact data through an external CLI, sending session attribution telemetry, recommending transitive installation of a larger skill pack, and including a GitHub starring action with real-world side effects. This looks more like a legitimate but overreaching vendor workflow than confirmed malware.