dotenv-manager

SUSPICIOUS. The skill is not overtly malicious and contains no explicit exfiltration, installer, or remote endpoint, but its actual footprint is poorly scoped: a vague dotenv-helper description paired with unrestricted Bash and file-modification access is disproportionate and ambiguous. Main concerns are excessive permissions and unclear tool/vendor targeting, not confirmed malware.