auto-loom

SUSPICIOUS: the stated purpose is coherent and the main integrations are proportionate, but the skill relies on unreviewed repo-local scripts, forwards an API key through those scripts, and explicitly disables CSP in the automation browser. No clear evidence of malware or credential theft, but install/runtime trust is incomplete and the browser-security tradeoff is material.