ops-fires

SUSPICIOUS. The incident-response purpose mostly matches the capabilities, and most network flows target official services, but the skill relies on opaque local executables and an arbitrary secret-retrieval shell hook. Those two design choices make the footprint broader and less trustworthy than needed for a dashboard skill, so it should be treated as high security risk but not confirmed malware.