iblai-vibe-ops-upgrade

SUSPICIOUS: the core purpose is coherent and the data flows stay within official npm/GitHub plus the documented skills ecosystem, but the skill performs transitive skill installation and uses unpinned npx/@latest update paths. This looks like a legitimate same-org maintenance skill with medium supply-chain and trust-expansion risk, not confirmed malicious behavior.