agentic-awesome-skills-installer

SUSPICIOUS. The installer's stated purpose matches its behavior, and the npm/GitHub sources appear genuinely tied to the same project, so this is not confirmed malware. However, it installs third-party code via `npx`, has inconsistent publisher branding (`ara.so` vs `sickn33`), stale version metadata, and most importantly acts as a transitive skill installer for 1,935+ downstream skills, which materially expands agent trust scope.