solid-astro

SUSPICIOUS. The core purpose and local file-access expectations are coherent for an Astro architecture skill, and the static command/data-theft findings are mostly documentation false positives. The main risk is proportionality/trust: it mandates transitive subagents and external documentation services, plus suggests unpinned npx execution, which makes it moderately risky despite no clear malicious or exfiltrating behavior.