ai-act-risk-check-hardened

SUSPICIOUS: the skill's stated purpose is plausible, but its actual footprint is inconsistent. It relies on an unspecified external `oracle` binary despite claiming no dependencies, and it routes potentially sensitive descriptions through an undocumented inference path that conflicts with its own non-exfiltration guardrail. Main risk is unverifiable dependency and unclear data flow, not confirmed malware.