project-fix

SUSPICIOUS. The visible skill is mostly consistent with a remediation workflow and shows no direct credential theft, exfiltration, or malicious installer behavior. However, the actual execution logic is hidden by assembly comments, and the skill explicitly treats `audit-report.md` as an action-driving spec, creating medium risk of prompt-injection-style unsafe changes if that report is untrusted or generated from hostile content.