security-scan

SUSPICIOUS. The skill is mostly coherent as a security workflow for AWS CDK and uses largely official tools/endpoints, but its scope is broader than its stated scanning purpose because it mandates code changes and real AWS deployment. Supply-chain risk is moderate due to curl|sh and uvx-from-Git usage, but the sources are verifiably official; the main concern is disproportionate operational impact, not confirmed malware or credential theft.