megadev-compression

SUSPICIOUS: the skill’s compression/validation behavior is coherent with its stated purpose and does not seek disproportionate credentials or unrelated file access, but it relies on an unverified Docker image from a different publisher using a mutable latest tag. Main risk is supply-chain trust, not confirmed malicious behavior.