sync

SUSPICIOUS: the stated purpose broadly matches a config-sync skill, but the actual footprint is powerful and depends on an unverified local Harness script plus optional SSH fan-out and transitive third-party skill installation. The main concern is install/execution trust and downstream trust chaining rather than clear malicious intent.