production-ready

SUSPICIOUS. The skill’s purpose and capabilities are mostly aligned with production-readiness auditing, and it tells the agent to ask before installing tools. However, it normalizes several remote installer flows (curl|sh from raw GitHub main branches) and broad third-party tool installation, which is disproportionate enough to raise medium risk even without clear credential theft or malicious data routing.