cli-hub-meta-skill

SUSPICIOUS: the hub package itself shows plausible same-project PyPI provenance, but the skill is primarily a transitive installer/marketplace for many downstream CLIs sourced from a live remote catalog. That broad trust expansion is coherent with its stated purpose, yet materially raises risk because installed packages and their later data flows are outside this skill's direct review.