cli-anything-generator

SUSPICIOUS: the core behavior is mostly coherent for a harness generator, with local file reads/writes and shell-based testing that fit the purpose. The main concern is transitive skill installation through `npx skills add` plus a distribution-status mismatch around the claimed Cursor plugin packaging; these create trust and supply-chain risk, but there is no clear credential harvesting, exfiltration path, or overtly malicious behavior in the provided skill text.