commit-staged

SUSPICIOUS. The stated purpose is legitimate, but the skill relies on load-time pre-execution commands, including `uv run prek run`, which can run repo-defined hook code before any approval or review. The git inspection commands are coherent, but automatic execution and index mutation make the skill high risk despite no direct evidence of credential theft or external exfiltration.