localization-i18n

SUSPICIOUS. Most content is benign i18n documentation using official npm ecosystem packages, but the companion-check behavior is not proportionate to a localization skill: it inspects local skill directories and encourages transitive installation of third-party skills from an unrelated repo. No credential theft or clear exfiltration is present, so this is not confirmed malware, but it carries meaningful trust-chain and scope-creep risk.