install-skill

SUSPICIOUS: the stated purpose matches its behavior, but that behavior is inherently high-risk because it installs unreviewed skills from arbitrary URLs and Git repos. The main issue is transitive trust and weak install provenance, not confirmed malware or direct credential theft.