update-config

SUSPICIOUS. The skill's capability matches its stated updater purpose, and the fetch/installer both come from the same public repo, so this is not fundamentally incompatible or clearly malicious. However, it auto-executes a remote installer from a mutable raw GitHub main branch without pinning, checksums, or per-step confirmation, making install trust materially risky for an agent skill.