setup

SUSPICIOUS: the skill’s purpose matches its actions, but it relies on executing an unpinned repo installer and then installs additional skills/plugins through a marketplace. This is coherent setup behavior, not clear malware, yet it carries medium supply-chain and transitive-trust risk.