task-status-sync

SUSPICIOUS: the skill’s purpose and capabilities mostly align, and no credential theft or exfiltration is described, but it delegates write authority to an unverifiable local script outside the provided skill content and is often installed through weaker transitive GitHub/registry channels. Risk is moderate supply-chain and local command-execution trust, not confirmed malware.