skill-creator

SUSPICIOUS: the stated purpose matches installing and creating skills, but the remote-install workflow is under-scoped on trust. It permits fetching arbitrary skills and following their setup files without provenance, checksum, or signature verification, creating a medium supply-chain and transitive-instruction risk rather than clear malware.