project-orchestrator

SUSPICIOUS: the stated purpose is coherent for project coordination, but the actual footprint relies on transitive skills, a third-party Linear CLI that may receive API tokens, and an intermediary cloud proxy for writes instead of Linear's official API. Those data-flow and trust-boundary choices are disproportionate enough to merit caution even without direct malware indicators.