promotion-gate

SUSPICIOUS: purpose and scope are coherent for a local promotion gate, and there is no visible credential harvesting or external data routing. The main risk is install/execution trust: the skill executes an unverifiable local script whose actual behavior is not provided, so the executable trust boundary is weaker than the benign documentation suggests.