goal-manager

SUSPICIOUS. The skill's purpose and local file access are proportionate for goal tracking, and no credential harvesting, network routing, or covert behavior is present. However, the core functionality depends on an unverified local CLI/script with unclear provenance, creating a high supply-chain trust risk despite otherwise benign scope.