compliance-audit

SUSPICIOUS. The core purpose is legitimate and the visible workflow is mostly consistent with compliance auditing, with no explicit exfiltration or malicious payloads. However, the skill is more powerful than a passive guide because it includes Bash and automated evidence collection, and it introduces unpinned transitive skill dependencies with no trust chain. Risk is medium due to overscoped execution potential and unresolved transitive trust, not confirmed malware.