manage-skills-hub

SUSPICIOUS: the skill's purpose largely matches its capabilities, and it includes strong guardrails around confirmations, hashing, and structured CLI output. However, it is a transitive skill-management skill that executes a local CLI bridge with unclear same-org provenance relative to the public website/npm evidence, so the trust chain is not fully coherent. High security risk stems from transitive installation plus ambiguous CLI publisher alignment, not confirmed malicious behavior.