rule-validate

SUSPICIOUS: the stated validation purpose is coherent, but the skill introduces a disproportionate supply-chain risk by invoking an unpinned third-party npm tool (`@rayhanadev/truffler`) via `bunx` without same-org provenance or verification guidance. No clear credential harvesting or exfiltration is present, so this is better classified as a risky workflow dependency than malware.