deps-runner

SUSPICIOUS: the skill’s core purpose is coherent, and it does not contain obvious malware patterns or risky installers, but it sends bearer-authenticated requests and repo-stage work to a configurable external PYLOT worker API that cannot be publicly verified from the provided material. The main risk is external data/credential routing and transitive trust in the referenced `pylot-workers` skill, not overt malicious behavior.