gstack-workflow

SUSPICIOUS. The supplied skill text is benign and report-only, but the discoverable upstream same-org implementation has a broader footprint: clone-and-execute installation, local helper binaries, and Bash/Write capability that exceed a minimal read-only QA skill. No clear credential theft or malicious exfiltration is evidenced, so this is not confirmed malware, but install trust and scope proportionality concerns make it medium risk.