qa

SUSPICIOUS. The core browser-QA and bug-fix behavior is legitimate, and the Bun installer evidence is same-purpose and officially sourced. However, the skill's footprint is broader than its stated QA role: it can alter CLAUDE.md routing, migrate gstack installation modes, scaffold tests/CI, write to home-directory state, and make autonomous commits. This looks more like a repo-management/orchestration skill bundled into QA than a narrowly scoped tester, so the main concern is overreach and install/execute trust rather than confirmed malware.