merge-checks

SUSPICIOUS. The stated purpose is coherent for a merge-audit skill, but it relies on opaque local scripts from a plugin cache and shell execution with argument forwarding. There is no clear credential harvesting or exfiltration path, yet install/execution trust is only partially verifiable and the Task agents process untrusted repository content.