action-validator

SUSPICIOUS: the skill’s stated purpose is advisory validation, but it also teaches a concrete method to bypass sensitive-path permission controls on `.claude/` using `/tmp` and Bash so the copy is not audited. There is no clear credential theft or external exfiltration, but the control-evasion guidance is materially inconsistent with a safety validator’s role and creates high local security risk.