ado-plan-build

SUSPICIOUS. The skill’s purpose and capabilities are largely aligned for an end-to-end Azure DevOps build loop, and it uses official Microsoft endpoints/tooling where specified. The main risks are its high autonomy, execution of repo-defined installer/build commands including `npx`, and ingestion of untrusted work-item/PR text while holding write and shell privileges. This looks more like a powerful but risky automation skill than confirmed malware.