start-work

SUSPICIOUS. The skill is largely aligned with its stated orchestration purpose, but it grants unusually broad autonomous authority: spawning many subagents, modifying repo/worktree state, invoking other skills, opening PRs, and potentially merging/shipping with little incremental approval. No clear credential theft, hidden exfiltration endpoint, or malicious installer is present, so this is not confirmed malware; the main concerns are autonomy, transitive trust, and operational blast radius.