security-scan

Mostly coherent security-audit skill with proportionate local file access, but it depends on an external CLI and has mild provenance ambiguity between ECC, the npm package, and the linked GitHub repo/action. Optional Opus mode forwards scan context using ANTHROPIC_API_KEY, which is disclosed and aligned with purpose but increases risk. Overall this is better classified as suspicious/medium-risk than benign due to supply-chain trust and external-analysis exposure, not because of clear malicious behavior.