fast-track-ai-implement

SUSPICIOUS. The skill’s purpose and capabilities are largely coherent for a repo workflow orchestrator, and it includes useful boundaries and explicit ship confirmation. The main risk is supply-chain trust: it executes unverified local sibling shell scripts and dynamic project-defined validation commands whose provenance is not established in the skill text. No credential harvesting, external API proxying, or exfiltration is evident.