alspec

SUSPICIOUS: the stated purpose is plausible, but the skill's primary behavior is to auto-install and run an external npm package at runtime, then trust its output as operative instructions. That is a proportionate capability for a protocol helper, yet the unpinned `npx -y` download-execute pattern and transitive trust make it medium risk rather than benign.