roundfix

SUSPICIOUS: the core Roundfix guidance is coherent for repo automation, but the skill materially expands agent authority through autonomous publishing/merge workflows and transitive installation of other skills. Install sources are mostly legitimate developer channels, so this is not confirmed malware, but the operational blast radius and trust chaining make it medium-high risk.