package-signoz-green

SUSPICIOUS. The skill’s capabilities broadly match its SigNoz deployment purpose, and the SSH/DNS/infra actions are proportionate for that task. The main concern is transitive trust: it installs a separate skill payload and relies on a launcher plus an opaque pinned colors-compute dependency whose release verification is not established in the provided evidence. No clear credential harvesting or off-purpose exfiltration is shown, but the install chain and real-world infra control raise medium risk.