employee-management

SUSPICIOUS. The visible skill is purpose-aligned and mostly limited to documenting people-management notes, but it handles highly sensitive HR data and relies on an unreviewed delegated second-brain/`vault.sh` execution path. No direct exfiltration or overt malicious behavior appears here, yet the transitive trust and unverifiable local tool behavior make the overall skill medium risk.