Skill Deprecation

This skill appears to be a legitimate deprecation/templating tool, but there are a few red flags you should resolve before installing or granting permissions: - Confirm permissions: the SKILL.md says it will update skill-registry.json, but its permissions only include read:skill-registry.json (no write). Ask the author to correct the manifest or explain how registry updates are performed. - Scope write access: the skill requests write access to skills/ — that lets it modify other skills' SKILL.md files. Only grant this if you trust the publisher and you have audit/logging and a human review process for destructive actions (e.g., marking REMOVED). Prefer scoping to specific paths or requiring an explicit human approval step for removals. - Notifications/side effects: the instructions mention notifying users and CRO-001, but no network/notification channels are declared. Clarify how notifications will be sent and ensure no secret/external endpoints are required. - Operational controls: if you install it, require explicit, logged confirmations for any operation that changes other skills or the registry, and consider keeping autonomous invocation disabled or limited until reviewed. If the publisher can correct the registry-write inconsistency and document exactly what runtime permissions and notification mechanisms it needs (and limit write scope), this skill could be acceptable. Until then, treat it as suspicious and avoid granting broad write permissions.