repo-skill-installer

SUSPICIOUS: the skill is coherent for repo-local skill management, but its core behavior is transitive skill installation from external sources. Because it imports third-party skill instructions into the repo without explicit source-content verification, it carries medium supply-chain risk despite otherwise proportionate scope and no direct credential exfiltration signs.