gsd-spike

SUSPICIOUS: the stated purpose is broadly coherent, but the skill is a high-trust orchestration wrapper with Bash, write access, and external content ingestion delegated through unseen local workflows. No direct malware or credential theft is visible, yet the combination of broad execution capability, web/MCP research, and persistent skill generation creates medium security risk.