develop-next

The visible code is a CI tree-equivalence checker and does not show direct credential theft, repository-data exfiltration, or a backdoor. Its principal security concern is intentional shell execution of `ci.docsOnly.checkCommand` from `skills-config.yaml`, allowing arbitrary commands in the workspace if that configuration is untrusted; severity is high in that trust scenario. The fragment is malformed/incomplete as supplied, and the value of BB_API cannot be confirmed from the visible code.