quality-manager-qmr

SUSPICIOUS. The supplied skill content is largely benign governance documentation and shows no direct credential theft or exfiltration, but the surrounding distribution evidence is inconsistent: the same skill name appears under multiple owners and is installed through repo-based third-party skill CLIs without clear official provenance or release verification. Risk is mainly supply-chain and transitive-installation trust, not confirmed malicious behavior.