watchpost

SUSPICIOUS: the skill’s core behavior fits its stated purpose, but its install trust is weak. It executes a mutable raw GitHub installer, and the available evidence shows naming/documentation inconsistencies between Watchpost and Dev Maestro plus a different documented installer path. No clear credential harvesting or external data exfiltration is stated, so this is better classified as medium supply-chain risk than confirmed malware.