issue-implement

SUSPICIOUS: The skill’s core purpose and repo-changing capabilities are coherent, but it has medium risk from transitive dependency trust. It requires/install-routes to unpinned external skills and an unspecified backend, so install provenance and data-flow trust are incomplete even though there is no clear credential theft or overtly malicious behavior.