claude-code-skills

SUSPICIOUS: The skill's purpose is coherent, but it normalizes installing arbitrary third-party skills by cloning unpinned GitHub repos into Claude's auto-load directories and points to a personal repo for expanded resources. No direct credential theft or malicious execution is present, but the transitive trust and supply-chain exposure are disproportionate enough to warrant caution.