delegation

SUSPICIOUS. The skill is broadly aligned with its stated delegation purpose and shows no obvious credential theft or exfiltration, but it grants an AI agent substantial autonomous control over code execution, branch manipulation, dependency installation, and transitive skill invocation. The biggest risks are autonomous real-world code changes and npm-based supply-chain exposure, not confirmed malware.