orca-runs

SUSPICIOUS. The skill's behavior is broadly consistent with its stated purpose of opening a local Orca run view, and there is no sign of credential theft or off-purpose data exfiltration. However, it depends on external `crew` code and first-run npm installation, while the claimed npm package/repository provenance was not independently verified from the supplied evidence, so the main risk is supply-chain trust rather than malicious behavior.