boatswain

SUSPICIOUS: the stated purpose matches repo hygiene and local Git custody, and there is no obvious credential theft or outbound exfiltration. However, the skill has meaningful security risk because it loads an unverified secondary skill and executes repo-defined commands from RIGGING.md while reading untrusted repository content, enabling transitive trust and prompt-injection/execution hazards beyond a simple hygiene role.