acquiring-skills

SUSPICIOUS. The skill’s purpose is coherent and the named repos are legitimate same-org sources, so this is not malware. However, it is a transitive skill installer that downloads external skill content from mutable GitHub branches and places it into active skill directories, which creates medium security risk despite the built-in safety guidance.