work

SUSPICIOUS. The skill’s capabilities largely match its stated purpose of coordinating WT work, and it does not show explicit credential theft, exfiltration, or remote installer behavior. The main risk is trust in an unverified wt CLI plus local eval of its output, which makes the skill operationally powerful without clear provenance evidence.