technical-debt-auditor

SUSPICIOUS: the skill’s stated purpose is coherent, and its audit tooling mostly uses official ecosystems, but its actual footprint is broader than a typical low-risk analyzer because it combines autonomous Bash, report writing, and Dockerized execution of untrusted repositories. Main concerns are indirect prompt injection from repo content and supply-chain exposure during dependency installation, not confirmed malware.