using-agent-skills

SUSPICIOUS: the documented purpose is coherent and the skill text is mostly restrictive, but it depends on an `agentit` CLI whose official provenance could not be verified, and the known install path is a third-party, unpinned transitive skill installation flow. No clear credential harvesting or overt exfiltration appears in the skill body, so this is high supply-chain risk rather than confirmed malware.