live-dependency-resolver

Mostly coherent and benign for live dependency verification: it uses official CLIs and official registry APIs, with no credential harvesting or suspicious data routing. The main concern is the unrelated companion-skill check and suggested third-party skill installation, which makes the overall skill suspicious rather than fully benign.