pm-skills

SUSPICIOUS: the stub is not overtly malicious, and its PM theme matches the upstream repo, but it primarily functions as a transitive installer for external skills. Same-org provenance lowers concern, yet the mismatched install instructions, unpinned latest versioning, and marketplace-based skill installation make this a medium-risk supply-chain/trust issue rather than a benign self-contained PM skill.