plugin-syncer

SUSPICIOUS. The skill's stated behavior matches its purpose, but it performs transitive plugin installation and cleanup through an unseen local script and unseen inventory, with no documented pinning, source verification, or integrity controls. Risk is moderate from supply-chain and broad environment-modification exposure, not confirmed malware.