gsd-orchestrator

SUSPICIOUS: the skill’s capabilities mostly match its stated purpose, but trust depends heavily on an external CLI and the install metadata is outdated versus official docs. Secret injection into that CLI and broad autonomous project actions are proportionate yet materially raise risk, so this is not malicious on its face but it is higher-trust-than-necessary and should use the current official package reference.