refactor-assist

SUSPICIOUS: The skill's stated purpose mostly matches its behavior, but it relies on executing an external npm CLI via `npx` and forwarding `OPENAI_API_KEY` plus local code to that package and an external model API. The main risk is supply-chain and credential/data exposure, not clear malicious intent.