requirement-workflow

SUSPICIOUS: The stated purpose mostly matches a development workflow orchestrator, and there is no direct evidence of credential theft or external exfiltration. However, the skill's core execution is delegated to unseen local shell scripts and it explicitly supports injected agents/skills without identifying their source, creating medium transitive-trust and execution risk disproportionate to a simple workflow helper.