package-dotfiles-green

SUSPICIOUS. The stated purpose and local file-writing behavior are coherent for a dotfiles skill, and no credential exfiltration or third-party API routing is evident. However, the skill's central dependency is an unverifiable local `./green` executable with no provenance or official install source in the instructions, which creates a significant supply-chain trust risk.