skills-store

SUSPICIOUS: The skill’s purpose matches its capabilities, but it normalizes loading and obeying remotely stored skills and optionally installing a local bridge skill that delegates trust to PostHog content. No direct credential theft or malicious payload is present, but the transitive trust model and instruction-following from shared remote content create a meaningful medium risk.