technical-research

SUSPICIOUS. The stated purpose is coherent, but the skill materially expands risk by pulling untrusted external content, cloning arbitrary repos, and optionally executing tests. No direct credential theft or malicious exfiltration is present, so this is not malware; the main concern is prompt-injection and supply-chain exposure disproportionate to a generic research skill.