red-handed-audit

SUSPICIOUS: the skill's stated purpose broadly matches its behavior, but it delegates sensitive transcript and repo inspection to an unpinned third-party npm CLI executed via `npx`. This is not overt malware, yet the install-and-run trust model and unverifiable 'nothing leaves the machine' claim create medium security risk.