afkkit

SUSPICIOUS: the skill’s capabilities mostly match its stated purpose, and its visible network flow is to official GitHub tooling, but it enables unattended external actions and depends on multiple unsourced companion kits that can execute repo scripts and mutate GitHub state. The main concern is high-autonomy orchestration plus unverifiable transitive skill trust, not confirmed malware or credential theft.