convention

SUSPICIOUS. The skill's main behavior matches its stated purpose of extracting project conventions, and its visible data flows are local rather than exfiltrative. However, it has broad execution and write powers, processes untrusted repo content while allowed to act, and delegates to other community-distributed sibling skills, creating medium supply-chain and transitive-trust risk disproportionate to a simple documentation helper.