lov-skill-optimizer

SUSPICIOUS. The skill’s capabilities broadly match its maintenance purpose, but it grants broad local write/sync/git-push authority through unverifiable repo-local scripts and a non-interactive workflow. No clear credential harvesting, exfiltration endpoint, or deceptive installer is present, so this is a medium-risk automation skill rather than confirmed malware.