agentic-lookml-workflow

SUSPICIOUS. The core Looker/GitHub automation matches the stated purpose, but the skill’s footprint is broader than necessary: it auto-installs transitive skills, uses risky unpinned installers, forwards Looker credentials into an external CLI, syncs local secrets into GitHub repo secrets, and publishes rich session artifacts to PRs. Same-org provenance reduces the chance of outright malware, but install trust and credential/data-flow scope are high enough to rate this as a high-risk vulnerable skill rather than benign.

SUSPICIOUS. The skill’s overall purpose is coherent for Looker/GitHub bootstrap, but its footprint is high-risk: it installs extra companion skills, forwards Looker credentials to a third-party CLI instead of an official SDK, and performs autonomous repo/secret/production changes. This is not confirmed malware, but the credential forwarding and transitive trust chain make it unsafe to treat as low risk.

This script automates a refactor pull request but also sends Looker configuration values, including a client secret, to GitHub repository secrets selected by data.json; it publishes session artifacts and diagnostics in the PR and comment without redaction. These actions may be intended automation, but an untrusted or incorrect repository target or sensitive artifact content could expose credentials or other data. Severity is a security warning requiring verification of repository authorization and artifact contents; no unrelated domain, hardcoded credential, or clear evidence of malicious intent is present.