facts-refine

SUSPICIOUS: the skill’s purpose and actions are coherent and local-only, with no visible credential or exfiltration behavior, but it depends on an unverifiable `facts` CLI whose provenance is not documented. That supply-chain uncertainty is disproportionate enough to keep overall risk high despite otherwise benign behavior.