amazon-variation-strategy

SUSPICIOUS: the skill's stated purpose is benign, but it instructs transitive installation of a remote skill through an unpinned CLI, and the install target does not cleanly match the verified public publisher namespace (`nexscope-ai`). No direct credential theft or exfiltration is shown, so this is not confirmed malware, but the trust chain is broader than necessary for a simple strategy guide.