algal

SUSPICIOUS: the stated purpose broadly matches developer workflow automation, but the skill outsources nearly all behavior to an unpinned external npm CLI with unclear publisher provenance and optional network/model gateways. This is not confirmed malware, but it carries meaningful supply-chain and trust-delegation risk disproportionate to a simple helper skill.