workflow

SUSPICIOUS: the stated QA purpose is plausible, but the footprint is too broad and autonomous for that role. The biggest issues are permissionless file deletion/editing including `.env` and dotfiles, plus consuming external review/web content while retaining write and execution powers. No clear evidence of malware or credential theft, but this is a high-impact agent skill that should be tightly constrained.