consolidate-strays

SUSPICIOUS. Most capabilities are proportionate to local stray-skill consolidation, but the final instruction to run an unpinned `npx skills add hu3rror/my-skills ...` introduces unnecessary transitive trust in a third-party skill source. This is not confirmed malware, but it meaningfully expands supply-chain risk beyond the skill's stated local recovery purpose.