refactoring

SUSPICIOUS. The skill’s core purpose and file access are coherent for refactoring guidance, and there is no evidence of credential theft, exfiltration, or hidden execution. However, it expands into optional installation/execution of third-party developer tools with mixed provenance: jscpd is well-verified, but Deslop’s standalone/MCP install path is unclear and truffler is a young personal-maintainer package run via bunx. This is proportionate to the task but increases supply-chain risk enough to classify the skill as suspicious rather than benign.