sprites-dev

SUSPICIOUS. The core remote-VM management capabilities are coherent with the skill's purpose and mostly use official Sprites and Tailscale endpoints, but the dev-setup path introduces a high-risk trust break: it reads secrets from 1Password, mints Tailscale credentials, forwards them into a remote VM, and then runs a personal raw-GitHub dotfiles installer via pipe-to-shell. SSH agent forwarding further delegates the user's GitHub identity to the remote VM. This is not confirmed malware, but the credential-forwarding and third-party installer footprint is disproportionate enough to warrant a high security risk classification.