a2a-protocol

Mostly a benign protocol-reference skill, but the companion-check behavior is a notable inconsistency: it scans local skill folders and encourages transitive installation of other skills, expanding trust beyond the stated A2A documentation purpose. No clear credential harvesting or covert exfiltration is present, so this is suspicious rather than malicious.