truedraft

SUSPICIOUS: the core writing, citation, and local file-writing behavior is coherent with the stated purpose, but the skill recommends installing additional skills from a personal GitHub repository via the skills CLI. That transitive trust expansion is disproportionate to a writing workflow and is the main risk. No direct credential harvesting, covert exfiltration, or malicious pre-execution behavior is present in this skill itself.