aldescription

SUSPICIOUS: the stated purpose is coherent, but the skill’s core behavior depends on an unpinned runtime `npx` download/execute path. I found plausible same-publisher npm/repo linkage, so this is not strong evidence of malware, but install trust is only moderate and the fetched CLI output effectively controls the agent’s workflow.