jb-beansloop

SUSPICIOUS. The skill's core purpose is coherent with a bean-driven developer workflow, and there is no clear credential harvesting or off-platform exfiltration. Risk comes mainly from unattended autonomous operation, tracker mutation, local command execution over repo-defined scripts, and transitive trust in other skills.