full

SUSPICIOUS: the core operator behavior is mostly aligned with its stated purpose, but the built-in community skill discovery/install step materially expands trust and lets external instructions enter a write/exec-capable agent. External LLM CLI routing is plausible for review, yet the transitive skill installation and untrusted-content processing make the overall skill medium-high risk.