bd-go

SUSPICIOUS: the skill is purpose-aligned and uses an apparently official same-org CLI, so it does not look malicious. Risk comes from autonomous real-world repo/task actions and moderate installer hygiene issues in the broader Beads distribution path.