api-key-manager

SUSPICIOUS: the skill appears mostly benign and documentation-like, but its actual footprint is not fully proportional to its vague stated purpose because it grants broad Bash(npm:*) execution without naming any required tool or package. No direct malware, credential theft, or exfiltration is present, but the wildcard npm capability creates medium supply-chain and execution risk.