shrimp-task-manager

SUSPICIOUS: the skill's planning purpose is mostly coherent, but its footprint depends on a third-party MCP tool from a personal GitHub repo and a documented runtime pattern that disables normal permission checks. No clear credential harvesting or exfiltration is shown, so this is not confirmed malware, but it carries meaningful supply-chain and execution-scope risk beyond a simple task-management guide.