configure-ecc

SUSPICIOUS: the skill’s behavior mostly matches its stated installer purpose, but it pulls unpinned remote content from an independently maintained GitHub repo and then installs many additional skills into trusted Claude directories. The main risk is supply-chain plus transitive trust expansion, not direct credential theft or overt malware.