rate-limiter-config

SUSPICIOUS. The skill’s stated purpose is benign, but its execution footprint is broader than necessary because it grants generic Bash with arbitrary npm package execution while providing no pinned tools, provenance, or validation workflow. No direct credential theft or exfiltration is shown, so this is not malicious, but it is a medium-risk, over-permissioned skill.