refactor

SUSPICIOUS: The skill’s core purpose and capabilities are mostly coherent for local refactoring, and there is no sign of credential harvesting or outbound exfiltration. The main concern is install/execution trust: it sources an undocumented local preflight.sh from $HOME/.codex/ship, and the publisher/provenance could not be independently verified. That makes it medium risk rather than benign, but there is not enough evidence to call it malicious.