ask-user-questions

SUSPICIOUS: The stated purpose is benign and proportionate, but the skill relies on a runtime-fetched npm CLI and the referenced package name does not cleanly match the same-author public documentation. No credential harvesting or malicious data flow is evident, so this looks more like supply-chain/trust inconsistency than malware.