add-onecli

SUSPICIOUS: the skill's purpose is coherent as a credential-injecting proxy, but its scope is overly broad and its data flow is high risk because official API access is funneled through a third-party intermediary for many unrelated services. Same-org install evidence lowers supply-chain concern, but the proxy-based credential forwarding and mandatory use for virtually all external access make this a high-risk integration.