epic-conductor

SUSPICIOUS: the skill is purpose-aligned and does not show a malicious installer or obvious credential-harvesting path, but it grants an AI agent broad autonomous control over repository actions, merges, and transitive skill execution while consuming untrusted GitHub content. The main risk is operational autonomy and prompt-injection exposure, not confirmed malware.