harness-engineering-lifecycle

SUSPICIOUS. The main risk is transitive skill installation from an unverified third-party repository through the skills CLI, plus broad cross-repo execution and modification scope. The skill is not overtly malicious and shows no credential harvesting or exfiltration path, but its trust chain and operational breadth are disproportionate enough to warrant caution.