package-json-manager

SUSPICIOUS: no explicit malware or exfiltration path is documented, but the skill is underspecified and over-permissioned for its stated purpose. The main concern is disproportionate arbitrary bash access relative to a vague package.json helper role.