to-spec

SUSPICIOUS. The core behavior matches the stated purpose, but the skill performs external publication and labeling, and it relies on a transitive setup skill/CLI trust chain. There is no clear credential-harvesting or attacker-controlled endpoint in the provided evidence, so this is not malicious, but it carries medium risk due to autonomous publishing and same-org unpinned skill installation.