using-slipbox

Suspicious. The stated purpose aligns with local workflow orchestration, and there is no clear credential theft or covert exfiltration in the visible instructions, but the skill's core capability depends on an opaque vault-local CLI that can mutate files and invoke Git. Because that executable is not externally verifiable, the skill carries high supply-chain risk despite otherwise coherent purpose.