cognitive-walkthrough-beads

SUSPICIOUS. The core capability is coherent: run a cognitive walkthrough and convert findings into Beads issues. The main concern is install/execution trust: the skill’s fallback instruction points to `pip install beads-cli`, which does not match the official documented Beads CLI distribution paths, creating avoidable supply-chain ambiguity. Aside from that mismatch, permissions and data flows are proportionate, local, and show no credential harvesting or exfiltration behavior.