sync-toycrane-skills

SUSPICIOUS: the skill’s purpose is coherent, but its footprint relies on transitive installation through a third-party CLI, unpinned `@latest` execution, and running code sourced from freshly installed upstream content. This looks like a legitimate automation workflow with meaningful supply-chain and trust-chain risk, not confirmed malware.