license-compliance-scanner

SUSPICIOUS: the skill is not overtly malicious and shows no credential theft or exfiltration path, but its purpose is vague and mismatched to its broad execution scope. The main risk is disproportionate Bash(npm:*) access for a generic, underspecified guidance skill.