dev

SUSPICIOUS: the skill’s developer-automation purpose is plausible, but its actual footprint is broader and less auditable than a simple dispatcher. Main concerns are dynamic inline workflow execution, unprovided `.whip` workflow contents, and a hardcoded direct local script execution path for smart self-test. No clear credential theft, exfiltration, or confirmed malware is visible.