mj-skill-creator

SUSPICIOUS: The skill’s capabilities mostly match its stated purpose as a skill-authoring workflow, but it includes transitive skill installation from a repo that was not strongly verifiable from the provided evidence, plus automatic global install and push actions. No clear credential theft or covert exfiltration is present, but the trust chain and real-world actions raise meaningful security risk.