research-challenge

SUSPICIOUS: The skill's core behavior mostly matches its stated purpose, but it has medium risk because it collects local transcripts and project artifacts and can publish them externally via GitHub. No malicious installer, hidden exfiltration endpoint, or credential-stealing pattern is visible in the provided text, but the broad file permissions and external submission flow make it riskier than a simple documentation skill.