gsd-update

SUSPICIOUS: The skill is broadly aligned with its stated update purpose and uses a normal npm workflow, but it executes an unpinned `@latest` installer from an archived personal fork instead of the current official upstream. No credential access or clear exfiltration is present, so this is not malicious, but the install trust is weaker than it should be for an updater.