maestro-collab

SUSPICIOUS: the skill’s orchestration purpose mostly matches its behavior, but it forwards potentially broad project context to multiple external CLIs through an only partly verifiable `maestro delegate` path, uses broad Bash/Write permissions, and can auto-persist outputs under `-y`. Main concerns are opaque downstream data flow and overpowered execution scope, not confirmed malware.