supsub-mp

SUSPICIOUS: the skill’s purpose and API workflow are largely coherent, but its trust model is heavier than necessary because it installs and relies on an external CLI using an unpinned `curl|bash` path with auto-update and browser auth. No clear malicious exfiltration is evident from the skill text alone, but the supply-chain and credential-forwarding footprint make it medium risk.