33god-projects

SUSPICIOUS. The skill’s capabilities mostly fit its project-bootstrap purpose, and the scanner’s command-injection findings are documentation artifacts. Risk comes from broad trust in internal unverifiable tooling/scripts, transitive skill installation/fan-out, plaintext secret materialization, and unpinned npx execution rather than clear malicious or deceptive behavior.