project-orchestrator

SUSPICIOUS: the stated purpose is coherent and the named OpenSpec dependency appears legitimate, but this skill mainly acts as a high-privilege orchestrator that installs trust in multiple unspecified child skills and can trigger code/test/git workflows. No direct malware or exfiltration evidence is present, yet the transitive-skill model and incomplete provenance keep overall risk at medium.