workflow-creator

SUSPICIOUS: The skill’s purpose and capabilities mostly align, but its main function is importing unreviewed third-party skills into the agent environment. The biggest issue is transitive supply-chain trust: it normalizes downloading community skills from many sources without strong provenance or integrity validation. No direct credential harvesting or exfiltration is evident from the provided content.