template-catalog

SUSPICIOUS. The skill's purpose matches its behavior, but it is primarily a transitive installer for third-party agents and runs an unpinned external npm package from a personal publisher. No direct credential theft or malicious exfiltration is shown in this file, yet the trust expansion and mutable install path make it medium-high risk.