dev

SUSPICIOUS: the skill’s core purpose is coherent with its capabilities, but it has a broad autonomous footprint and executes an unverified local bootstrap script. Main concerns are execution trust for the sourced preflight script and prompt-injection risk from reading repository content while retaining write/bash/subagent powers; no clear credential harvesting or overt malicious exfiltration is shown.