build-task

SUSPICIOUS: the skill’s purpose broadly matches software-task automation, and there is no direct evidence of credential theft or malicious exfiltration. However, its scope is unusually expansive and it delegates critical actions to opaque subagents with partially verifiable provenance, while enabling autonomous shipping/task-updating behavior. Main risk is workflow overreach and trust in hidden downstream agents, not confirmed malware.