related-skill

SUSPICIOUS: the skill’s stated purpose matches its behavior, but that behavior is inherently high-trust because it installs other skills. Same-org inference-sh references are somewhat coherent, yet the wildcard Bash permission, unpinned `npx skills` installs, and unverified `belt-sh/cli` recommendation make this a medium-high transitive supply-chain risk rather than benign discovery-only guidance.