run-skill-generator

SUSPICIOUS. The skill's behavior is mostly aligned with its stated purpose, but it grants broad install-and-execute authority over arbitrary target projects and combines untrusted content ingestion with code execution and file writes. I found no strong evidence of credential theft or malicious exfiltration, so this looks like a high-exposure automation skill rather than malware.