skill-map

The skill’s behavior is coherent with its stated purpose: local skill discovery and reporting with explicit guardrails against sensitive or noisy paths. The main risk is not hidden exfiltration or command injection, but reliance on an external CLI (ai-skillet) whose provenance could not be verified from the provided evidence; this makes the skill suspicious from an install-trust perspective, not malicious in intent.