update-config

SUSPICIOUS. The skill's purpose mostly matches its behavior, but it performs unpinned remote code execution from a GitHub raw URL and instructs the agent to proceed without confirmation. This is primarily a supply-chain and autonomous execution risk rather than confirmed malware.