sync-superpowers

SUSPICIOUS: the skill's purpose is coherent and its network targets are official GitHub endpoints, but it imports mutable remote skill instructions from a personal repo and can persist them into local agent skills. The main risk is indirect prompt injection and unpinned trust in upstream content, not confirmed malware or overt credential theft.