subagent

SUSPICIOUS: the skill’s purpose broadly matches repo task execution, but it is high-friction because it mandates autonomous remote actions (`git pull`, `bd sync`, `git push`) and treats push as compulsory. The main risk is not malware but unsafeguarded external side effects and an unexplained `bd` dependency.