soia-dev-agent-md-advisor

SUSPICIOUS: the skill’s stated behavior is mostly benign and proportionate, with no clear credential theft or exfiltration flow, but its install model is riskier than its purpose warrants. The main concerns are third-party transitive installation via `npx skills add` and the wildcard `-a '*'` permission request for a largely read-only advisory skill.