postplan

SUSPICIOUS: the skill is mostly coherent with its publishing purpose and its upload/fetch behavior is explicit, but it relies on executing an external npm CLI whose provenance was not verified here, and authentication appears to involve a separate third-party domain. Risk is driven more by install trust and public upload exposure than by clear malicious behavior.