skills-managing

SUSPICIOUS: the skill’s stated purpose matches skill management, but it normalizes importing and activating third-party skills from arbitrary repos without provenance checks, creating a transitive trust chain. No confirmed credential theft or malware behavior is present, but the external-skill ingestion workflow is materially risky and internally inconsistent with its own registry guidance.