sigcli-auth-proxy

The skill is coherent with its stated purpose: it is explicitly an auth proxy, so credential extraction, storage, injection, and proxying are expected. The main risk is not hidden exfiltration in the instructions but the large trust placed in an external CLI that captures browser tokens, runs a MITM proxy, and can pass credentials to other commands; combined with optional raw token output and SSL-verification bypass advice, this makes the skill medium risk but not clearly malicious.