starworkSpawn

SUSPICIOUS. The skill’s actions are mostly coherent with its stated workspace-blueprint purpose and it does not request credentials or route data off-host, but it relies on an unverified local starwork binary whose provenance could not be confirmed publicly. That makes this more a trust/supply-chain concern than confirmed malware.