auto-skill

SUSPICIOUS. The skill’s capabilities mostly match its stated meta-skill purpose and data stays local, so it is not strong evidence of malware. Risk comes from automatic hook execution, silent local scripts with no provenance details, and a transitive dependency on another skill not included for review.