qa-report-generator

SUSPICIOUS. The skill’s stated purpose and data access are mostly coherent and proportionate, and there is no clear malware or credential-harvesting behavior. The main risk is install/execution trust: a locally discovered, unverified Python CLI is executed from a first-match filesystem search path, and the publisher/provenance could not be independently verified; webhook egress is also underspecified.