skill-discovery

SUSPICIOUS rather than malicious. The skill's behavior is broadly aligned with local skill discovery and evidence verification, and its data flow stays local in the provided text. The main issue is install/execution trust: it requires a `lev-skills` CLI with insufficient verifiable release provenance, which creates a high supply-chain risk even without obvious exfiltration or credential theft.