devmacbridge

SUSPICIOUS. The skill’s capabilities mostly fit its stated purpose, and it includes meaningful safeguards against secret exposure and destructive repo actions. However, it installs and operationalizes a bridge from a personal GitHub repository, configures OAuth/connector flows, and uses UI automation plus local token handling to connect Web ChatGPT to local tools. That footprint is coherent for a bridge-setup skill but carries elevated trust and credential-routing risk because the core bridge is third-party infrastructure rather than an official vendor-owned integration.