validate-skillmd

SUSPICIOUS. The core purpose is coherent, and most flagged shell patterns are documentation artifacts, but the skill contains a real pre-execution directive and uses weaker-than-official JRig installation guidance. No clear credential theft or exfiltration is shown, but the load-time execution footgun and supply-chain trust mismatch make this unsuitable to classify as benign.