skills-manager

SUSPICIOUS: The skill is internally coherent and uses official same-org tooling, so it does not look malicious. However, its main function is installing and updating other skills from GitHub via `npx skills`, which creates meaningful transitive trust and supply-chain risk; use is reasonable only if the target skill repos are trusted and reviewed.