skills-management

SUSPICIOUS: the skill is coherent with its purpose and includes sensible security vetting steps, but it materially enables transitive installation of third-party skills and relies on unpinned external CLIs and remote skill sources. This is not malicious, but the trust chain and install surface make it medium risk.