commit-wip

SUSPICIOUS: the wrapper’s stated purpose is narrow and plausible, but it delegates core behavior to an unpinned external skill whose public distribution appears to come from a third-party/personal raw GitHub source. The main risk is transitive trust and supply-chain ambiguity, not direct malicious behavior in this file.