pm-skills

SUSPICIOUS. The stated purpose is coherent with project-management and Atlassian automation, but the install path relies on a third-party skill installer and introduces transitive trust. No direct credential theft, exfiltration, or malicious execution appears in the provided skill text, so this looks more like elevated supply-chain risk than confirmed malware.