darwin-skill

SUSPICIOUS: the skill’s core behavior mostly matches its stated purpose, but install/execution trust is weaker than it should be for a developer tool. The main concerns are unverifiable distribution signals (R2 ZIP, no signed releases/checksums), a non-portable hardcoded dependency path, and processing untrusted skill content while retaining write and command execution abilities. No strong evidence of credential theft or intentional exfiltration.