env-manager

SUSPICIOUS. The skill is mostly coherent for env validation and secret scanning, but its footprint is broader than advertised: optional docs include networked sync/push operations, external CLIs/SDKs, and secret forwarding while the main skill claims 'No network calls' and 'Zero dependencies.' No clear exfiltration to unrelated endpoints or confirmed malware, but the misleading scope claims and Railway endpoint mismatch make it internally inconsistent.