marketingskills-ai-agents

SUSPICIOUS: the skill’s stated purpose matches its behavior, but its main function is transitive installation of a third-party skill pack from a personal GitHub repo using unpinned fetch methods. No credential theft or exfiltration is evident, so this is not malware, but it carries meaningful supply-chain and inherited-permission risk.