adhoc-skill

SUSPICIOUS: the core repo-edit and local sync behavior matches the stated purpose, and no credential theft or external exfiltration is evident. The main concern is install/execution trust around the undefined skill-creator and local fanout script, especially if skill-creator is obtained through a transitive third-party skill install path. This is a medium-risk skill-management tool rather than confirmed malware.