map-systems

SUSPICIOUS. The stated purpose is a benign project-planning workflow, and the file reads/writes broadly match that purpose. However, the skill uses load-time pre-execution of a repo-local shell script whose contents are not provided or verifiable here. There is no evidence of remote code fetch, credential theft, or exfiltration, so this is not confirmed malware, but the pre-execution mechanism and transitive skill handoffs raise material security risk beyond a normal documentation/planning skill.