ctx-upgrade

SUSPICIOUS: the skill's capabilities broadly match its purpose as a local upgrader, but it delegates powerful upgrade/install behavior to an unseen CLI that pulls from GitHub and modifies global/npm/hook state. The main concern is install-trust and opaque downstream actions, not clear evidence of credential theft or malicious exfiltration.