wk-skill

SUSPICIOUS due to transitive skill installation and third-party `npx skills` execution, but not malicious. The behavior mostly matches the stated purpose of scaffolding and installing a local skill, with the main risks coming from runtime npm execution, activating generated skills, and broad local bash/write capability.