harness-engineering-lifecycle

SUSPICIOUS: the skill’s stated purpose is coherent, but its install path introduces medium risk through unpinned transitive skill installation via a third-party CLI. There is no clear credential harvesting or exfiltration behavior, so this looks more like a supply-chain and trust-boundary concern than malware.