npm-scripts-optimizer

SUSPICIOUS. The skill appears mostly benign and documentation-like, with no explicit credential harvesting or exfiltration, but its unrestricted Bash permission is broader than necessary for a narrowly described npm scripts helper. Risk is driven more by overbroad execution scope and partial installer trust verification than by malicious data flows.