install-from-remote-library

SUSPICIOUS: internally consistent as an installer helper, but its purpose is to install other remote skills, which is inherently a transitive trust and supply-chain risk. The same-org CLI evidence reduces malware suspicion, yet allowing installation from arbitrary remote libraries keeps overall risk medium-high.