molten-skill-manage

SUSPICIOUS: the skill is coherent with its stated purpose, but that purpose is inherently high-trust because it installs and manages other agent skills through a third-party CLI and remote repositories/URLs. The official provenance of `npx skills` lowers malware concern, but transitive skill installation and broad supply-chain exposure make this a medium-to-high security risk.