skills-cli

SUSPICIOUS: the skill is coherent with its stated purpose as a package-manager guide, and the `skills` CLI itself appears to be an official documented tool. However, the skill’s whole function is transitive installation of external skills from varied sources, including arbitrary git URLs and personal publishers, so the main risk is delegated trust and supply-chain exposure rather than direct malware behavior.