plankton-code-quality

SUSPICIOUS: the skill's behavior mostly matches its stated code-quality purpose, but it materially expands agent autonomy through always-on hooks and delegated Claude subprocesses, and it relies on a manually installed personal-repo tool rather than a registry package. No clear credential harvesting or exfiltration is described, so this is not malware, but it carries medium security risk and transitive trust concerns.