shipwright

SUSPICIOUS: the core repo-inspection and annotation behavior is broadly consistent with the stated purpose, and there is no clear exfiltration or credential theft path. However, the skill requires loading an additional unverified skill and grants broad local command/package-manager authority, making the trust chain and execution scope larger than expected for a documentation-style inspection role.