k2f-case-study

SUSPICIOUS: the visible skill content is a benign writing/template guide, but it delegates core execution to an unreviewed third-party skill. The main risk is transitive trust: installing `suzheng/k2f` can expose user content and agent permissions to code/instructions outside this skill's reviewed scope.