feature-lifecycle

SUSPICIOUS: the workflow purpose and capabilities mostly align, and there is no clear credential theft or exfiltration path, but the skill requires executing an unverified local script from ~/.claude/scripts. That unverifiable executable dependency makes the skill high risk under the required scoring rules, even though malicious intent is not evident.