and-implement

SUSPICIOUS: the skill’s git/worktree/commit behavior matches its stated implementation purpose, and it does not directly request secrets or execute remote installers. The main risk is transitive trust: it relies on unspecified external skills and an undisclosed backend for contract retrieval and receipt recording, so install provenance and final data destination cannot be verified from this file alone.