gsd-orchestrator

SUSPICIOUS: the skill’s purpose largely matches its capabilities, but the install metadata is inconsistent with the official package identity and the skill forwards secrets to that external CLI for autonomous operation. The main concern is supply-chain trust plus credential forwarding, not confirmed malware.