agency-orchestrator

SUSPICIOUS: the skill’s purpose is coherent, but its actual execution path relies on an unverified, unpinned npm package run via `npx -y`, and it advertises autonomous GitHub workflow actions. Main risk is supply-chain and downstream action authority rather than confirmed malware.