nasiko-control-plane

SUSPICIOUS. The skill is mostly coherent and narrowly scoped for CLI lifecycle management, with strong consent and safety boundaries, but it depends on ECC as a transitive installer and the claimed pinned Nasiko CLI artifact/version could not be independently verified from public upstream release evidence. This looks more like medium supply-chain risk than malware or credential theft.