harness-synthesizer

SUSPICIOUS: the core purpose is plausible, but the skill includes explicit instructions to evade sensitive-path protections by writing in /tmp and copying into .claude/ via an unaudited script path. That bypass behavior is disproportionate to a harness-synthesis skill and is the main driver of risk; there is no notable external supply-chain component.