quest-complete

SUSPICIOUS: the skill’s purpose matches its capability, but it delegates decision-making and merge execution to an external CLI and tells the agent to follow that tool’s output. The setup source is same-repo and not obviously deceptive, so this is not confirmed malware, but the combination of opaque external execution and autonomous merge actions makes the skill high-impact and risky.