hindsight-maintenance

SUSPICIOUS: the core maintenance purpose fits the capabilities, and most shell/SQL actions are proportionate for a self-hosted Hindsight admin skill. Risk rises because it schedules headless agent execution with `--dangerously-skip-permissions`, routes API activity to a non-vendor-verified endpoint, and transitively invokes an unreviewed `karpathy-llm-wiki` skill. Not confirmed malware, but medium-high security risk from approval bypass, transitive trust, and partially unverifiable data flows.