engineering-features-for-machine-learning

SUSPICIOUS. The skill’s stated ML purpose is plausible and there is no explicit credential theft or exfiltration, but its actual footprint is under-specified: it relies on an unnamed/unspecified plugin runtime, grants unrestricted Bash, and the only surfaced install path for the plugin goes through a third-party marketplace catalog rather than a clearly official same-publisher source. That makes trust and execution scope weaker than the benign documentation suggests.