configure-agent-pr-attestation

SUSPICIOUS: the skill’s purpose broadly matches its behavior, but it requires an external harness-scs binary whose provenance is not established by the supplied evidence and then forwards sensitive attestation inputs and auth context to it automatically. Credential handling and upload behavior are proportionate to attestation setup, but the unverifiable CLI dependency and background hook execution make this a high-risk vulnerable skill rather than confirmed malware.