auto-oversight

SUSPICIOUS. The skill’s purpose is framed as oversight, but its actual footprint is an autonomous operations agent with authority to merge, deploy, edit system automation, and mutate shared state on a cron. Install trust is mixed: official Bun usage is coherent, but unpinned `npx tsx` adds third-party runtime supply-chain risk. The strongest issue is autonomy scope, not confirmed malware or exfiltration.