jev-rules

SUSPICIOUS: the skill’s purpose is coherent, and there is no evidence of credential theft or network exfiltration, but it uses load-time pre-execution and may run an unverifiable local CLI from PATH or ~/.claude before the agent sees the content. That behavior is disproportionate to a documentation-style rule-authoring skill and creates a high trust/supply-chain risk.