jfrog-ai-catalog-skills

SUSPICIOUS: the skill is largely coherent with its stated JFrog catalog-management purpose and uses same-org infrastructure, so it is not malware-like. However, it performs transitive skill installation and runtime execution of remote tooling (`npx --yes`), which creates a meaningful supply-chain and permission-inheritance risk even with official provenance.