.agents

SUSPICIOUS: the skill is internally consistent and uses an apparently official CLI, but its main purpose is to discover and install other skills, including third-party sources. That transitive installation behavior is a meaningful security risk even without direct malicious behavior or credential theft in this skill itself.