manage-marketplace

SUSPICIOUS: the skill is mostly coherent documentation for marketplace management, but it also instructs the agent to register external marketplaces and install third-party plugins, creating a medium-risk transitive trust path. No clear credential theft or exfiltration is present, yet the external plugin installation capability is broader than simple catalog authoring and materially increases supply-chain and prompt-injection risk.