orchestrate-herdr

SUSPICIOUS. The skill is purpose-aligned for multi-agent repo orchestration and uses official-looking tools, but it deliberately suppresses permission prompts and enables autonomous merges, issue updates, and agent control. Data flows stay mostly within herdr, git, GitHub, and GitLab, so this is not confirmed credential theft or malware; the main risk is high-impact autonomous workflow control with reduced approval safeguards.