sync-skills

SUSPICIOUS: the skill’s behavior matches its stated purpose, but that purpose itself is to perform transitive skill installation and removal using an unpinned runtime-fetched CLI. Data flow is mostly consistent and there is no direct credential theft or exfiltration, yet the trust chain and bulk remote installs make this a meaningful security risk rather than benign.