running-check-script

SUSPICIOUS. The skill’s core behavior matches its purpose—run `check`, fix failures, and remediate audit issues—but it grants very broad autonomous power to edit code, rewrite lockfiles, apply overrides/patches, and perform major dependency changes until green. Install sources are standard package managers and no third-party credential-routing or exfiltration is evident, so this is not malicious. The main risk is disproportionate autonomy and supply-chain impact for a build-check helper, especially in blocking workflows that let the agent keep mutating the repo until success.