skill-improver

SUSPICIOUS. The skill’s core behavior mostly matches its stated purpose, but it has a broad footprint: it mines private local conversations across projects, exports excerpts into GitHub PRs, autonomously changes repos, and refreshes upstream meta-skills through an external CLI updater. The main concern is moderate supply-chain and autonomous-action risk from `npx skills update` plus scheduled PR/auto-merge behavior, not confirmed malware or hidden exfiltration.