gemini-devfleet

SUSPICIOUS: the stated purpose matches multi-agent orchestration, but the skill’s effective trust boundary is a local DevFleet MCP service that is not verified by the skill itself, and it enables high-impact autonomous repo changes via parallel agents and auto-merge. No clear credential harvesting or malicious exfiltration appears in the skill text, but the autonomy and implicit trust in a local orchestration backend make it medium risk.