session-security-checker

SUSPICIOUS: the skill looks mostly like generic guidance, not overt malware, but its broad Bash(npm:*) permission is larger than its vague session-checker purpose justifies. No explicit exfiltration or malicious payload is present, yet the unconstrained npm execution scope creates avoidable supply-chain and execution risk.