proposal-writing

SUSPICIOUS: the proposal-writing guidance itself is benign, but the companion-check introduces unnecessary local enumeration and a transitive skill-install flow to an unpinned third-party GitHub repo. This is a moderate supply-chain risk and poor scope fit for a writing skill, though there is no evidence of direct credential theft or data exfiltration.