altimate-code

SUSPICIOUS: the skill’s purpose and capabilities mostly align, and the install source appears publisher-linked and npm-based rather than obviously malicious. However, it delegates sensitive data-engineering tasks to a separate agentic CLI, requires `--yolo` auto-approval, and forwards prompts/project context plus preconfigured provider and warehouse credentials through an external tool whose downstream actions are not fully visible here. This is a coherent but high-trust delegation skill, not confirmed malware.