go

SUSPICIOUS: the skill’s behavior mostly matches its stated purpose as a skill manager, but it carries meaningful trust risk because it installs and updates skills transitively and defaults to executing same-org code from a mutable GitHub branch. No clear credential theft or malicious exfiltration is shown, so this looks more like a medium-risk management skill than confirmed malware.