agent-best-practices

SUSPICIOUS: the skill is internally coherent as a best-practices guide, but its autonomy guidance is overbroad for a generic reference skill. The instruction to act without asking and to 'just push' enables real-world actions without explicit approval. There is no evidence of malware, credential harvesting, suspicious installation, or covert exfiltration.