project-env-manager

SUSPICIOUS: The skill's purpose is coherent, but it delegates shell execution to arbitrary commands stored in `project-env.yaml` without installer provenance checks. It is not overtly malicious and has a useful approval gate, yet its execution surface is broader than a passive environment-audit skill and should be reviewed alongside the repository contract before use.