Name/description match the included artifacts: a documentation-oriented SKILL.md and a shell script that emits reference text. No unrelated binaries, env vars, or credentials are requested.

SKILL.md promises plain-text heredoc outputs with no network calls or credentials. The bundled script implements this: it only prints static documentation blocks, implements local subcommands, and does not read files, env vars, or call external endpoints. Minor inconsistency: the SKILL.md header shows version 2.0.3 while scripts/script.sh sets VERSION=2.0.2 and registry lists 2.0.4, and show_help uses a single-quoted heredoc so the $VERSION token will not expand (help will display the literal '$VERSION'). These are non-security functional inconsistencies.

No install spec (instruction-only). No downloads or extracts. The only code is a small local shell script; nothing is written to disk during install because there's no install step defined.

The skill declares and requires no environment variables, no credentials, and no config paths. The script also does not read environment variables or secret-looking values—requested access is proportional to the stated purpose.

always is false, the skill is user-invocable and does not request persistent or elevated privileges, nor does it modify other skills or system-wide settings.