better-skill-publish

This is a repository-generation utility with no evident malware, network exfiltration, or credential theft. Its main security concern is unvalidated path construction from --repo and the SKILL.md name, which can redirect writes and, for an existing destination, trigger recursive deletion even without --force; copytree also follows symlinks. Treat generation from untrusted inputs as a filesystem safety risk; severity is moderate, and no domains, IPs, or credentials are targeted.