iso27001-gap-analyzer

SUSPICIOUS: the skill is not overtly malicious and shows no credential harvesting or exfiltration, but its actual footprint is loosely scoped. A generic ISO27001 guidance skill requesting unrestricted Bash access is disproportionate to its stated purpose, while the official npx install path adds moderate supply-chain trust risk.