blueprint-autopilot

The skill is mostly aligned with its stated blueprint-maintenance purpose and uses official GitHub tooling rather than suspicious third-party endpoints. Risk comes from load-time shell execution of unseen local scripts and unattended GitHub/file mutations, so this is better classified as suspicious/high-vulnerability behavior than confirmed malware.