The name/description describe a local reference for Cc Switch and the bundle contains only a SKILL.md and a single shell script that emits documentation. There are no unrelated environment variables, binaries, or cloud credentials requested. (Minor note: the script and SKILL.md indicate version 3.0.2 while registry metadata lists 1.0.0 — likely a packaging/versioning mismatch, not a security concern.)

SKILL.md explicitly instructs the agent to return plain-text heredoc outputs and states no external API or network usage. The included scripts implement only static text output and a small CLI dispatcher; they do not read arbitrary files, environment secrets, or contact remote endpoints.

There is no install specification (instruction-only) and the only code is a harmless local shell script. Nothing is downloaded or extracted from external URLs, so installation risk is minimal.

The skill declares no required environment variables, no credentials, and the script does not access external env vars beyond an internal VERSION constant. Requested environment/credential access is proportionate (none).

The skill is user-invocable, not forced-always, and does not attempt to modify agent configuration or persist credentials. It does not request elevated or ongoing privileges.