k2f-media-kit

SUSPICIOUS: The skill’s stated purpose is coherent, and its content-authoring instructions are benign, but it delegates core execution to an externally installed skill. That transitive installation is the main risk: it expands trust to unreviewed remote instructions with no version pinning, though the source appears to be part of the project’s documented ecosystem rather than an unrelated exfiltration path.