autoresearch

SUSPICIOUS: the skill is mostly a planning template, but it normalizes autonomous overnight loops in real-world domains and suggests a non-pinned third-party repo/tooling path. There is no direct exfiltration, credential harvesting, or hidden execution, so this is not malware; the main concerns are autonomy scope and moderate supply-chain trust.