ctx-upgrade

SUSPICIOUS. The stated purpose matches an upgrade skill, but the primary workflow tells the agent to execute an opaque shell command returned by an MCP tool, creating medium supply-chain and command-execution risk. The fallback path is locally scoped and same-purpose, which argues against confirmed malware, but the hidden command and unpinned upgrade flow make the skill riskier than a normal documented upgrade guide.