just-auto

SUSPICIOUS. The skill is coherent as an autonomy/orchestration wrapper, but its actual footprint is broader than a single skill because it chains into other repo-hosted skills and is designed to run with minimal approval gates. No direct credential theft or exfiltration is visible, so this is not confirmed malware; the main risks are autonomous action and transitive trust.