melech

SUSPICIOUS: the stated purpose and capabilities mostly align, and credentials/data flow are limited to GitHub plus local status scripts. The main risk is transitive trust: this skill is designed to install/update other skills from a personal GitHub repo through the Skills CLI, so the security exposure is moderate even though the skill itself does not show direct exfiltration or stealth.