meta-skill-importer

This PowerShell snippet is primarily a remote “fetch-and-install” mechanism: it clones an arbitrary caller-supplied Git repository and moves an arbitrary caller-supplied subdirectory into a local library, then modifies SKILL.md. There are no integrity/authenticity safeguards (no commit pinning, signature/checksum verification, or allowlisting), and $SkillPath is not explicitly validated to constrain it to a safe expected subtree. No direct malware primitives are present in the snippet itself, but in an untrusted context it meaningfully increases the risk of importing and installing malicious or unexpected code/artifacts as part of a supply chain.