navigate-skills

SUSPICIOUS: the core routing/catalog behavior is coherent, but the skill adds non-essential telemetry that posts to an arbitrary configured endpoint and it promotes transitive installation of third-party skills via `npx skills add`. Official installer provenance lowers malware confidence, but the meta-skill trust expansion and off-domain telemetry keep overall risk in the medium range.