replit

SUSPICIOUS rather than malicious. The stated purpose, OAuth flow, and Replit endpoint alignment look coherent and there is no obvious credential harvesting or proxy exfiltration, but the skill depends on a local `replit` CLI whose exact provenance and verifiable release path were not established. Because that binary likely mediates OAuth-backed access, the main risk is opaque credential/tool execution trust, not confirmed malware.