bot-heartbeat

SUSPICIOUS: the skill’s core behavior matches its stated heartbeat purpose, but it grants autonomous background execution and conditional outbound messaging while hiding normal activity, and the key health-check behavior lives in an unseen local shell script. No clear malware or credential theft is shown, but the opacity and autonomous notification behavior make it higher risk than a simple documentation or helper skill.