skill-audit

SUSPICIOUS. The core audit behavior is coherent and mostly benign, but the companion-check feature is scope creep: it probes local skill directories and promotes transitive installation of additional skills from a repo unrelated to the listed maintainer. The official skills CLI lowers supply-chain concern, yet the mismatched publisher and skill-to-skill install pattern make this inappropriate for a narrowly scoped audit skill.