cua-capability-dispatch

SUSPICIOUS: the core dispatch/runtime guidance is broadly consistent with a computer-use integration skill, and the credential/config references mostly serve that purpose. However, the skill's footprint is larger than its description suggests: it depends on an external runtime, launches configured workers, can retrieve credentials through files/SSH, and authorizes autonomous GitHub issue posting. The main concern is scope proportionality and action autonomy rather than clear malware or deceptive exfiltration.