codometer-measure

SUSPICIOUS: the skill’s purpose and capabilities are mostly coherent and locally scoped, with no credential or exfiltration behavior. The main concern is install trust: it relies on npx for a package name that was not independently verified from the evidence, while a differently named package was found instead; the companion-skill reference adds some transitive trust risk.