vault-consolidate

SUSPICIOUS: the workflow and permissions fit the stated purpose, and there is no clear exfiltration or credential harvesting behavior. However, the skill’s core capability depends on an unverified local vault-cli binary with no documented provenance, install source, or release verification, creating a high supply-chain trust gap disproportionate to the missing documentation.