sales-spree

SUSPICIOUS: the core Spree guidance is coherent and mostly benign, but the skill includes a transitive skill-install instruction to a separate third-party publisher (sales-skills/sales) that does not match the declared Spree GitHub identity. No direct malware or credential exfiltration is evident, but the trust-chain expansion makes the skill medium risk.