project-health

SUSPICIOUS. The core behavior matches a project configuration/audit skill, but its recommended permission footprint is broader than necessary: it normalizes extensive Bash/network capabilities, blanket web access, and transitive skill management for many projects. No confirmed malware or credential harvesting is present, yet the scope expansion and trust-chain risks make it more than low risk.