stelow-product-scope-executor

SUSPICIOUS: the skill is broadly aligned with an execution-orchestrator purpose, but it grants excessive autonomous code-execution authority, processes external plan content before taking actions, and references incompletely verified package provenance. No clear credential theft or exfiltration is present, so this is high-automation operational risk rather than confirmed malware.