update-pepper

SUSPICIOUS. The skill’s git and validation capabilities are broadly aligned with its stated purpose, but trust is weakened by an unverifiable default upstream repository, support for arbitrary user-supplied remotes, execution of repo-local npm scripts, and transitive invocation of other skills. This is not confirmed malware, but it has meaningful supply-chain and trust-boundary risk.