configure-ecc

SUSPICIOUS: The skill's behavior mostly matches its stated purpose as an ECC installer, and I found no credential harvesting or exfiltration. However, it clones unpinned content from a personal GitHub repo and installs many downstream skills into active agent directories, so the transitive trust and mutable-source supply-chain risk make it higher than benign.