tasks

SUSPICIOUS: the stated purpose is coherent for a task-management skill, and the flagged command-injection pattern is benign documentation text. However, the skill's core functionality depends on unverified external CLIs (`ttasks`, `cli-text`) with no documented official provenance, install path, or release verification, while still enabling the agent to perform remote writes and workflow actions. The main concern is install/execution trust and opaque data routing, not confirmed malware.