skills-cli

SUSPICIOUS. The skill is internally coherent for a skill-management CLI and uses an official, verifiable external tool, so it is not malware. Risk comes from transitive trust: its purpose is to install and manage other skills, including global agent-visible copies, so using it can extend the agent's trust boundary to additional skill content.