plate

SUSPICIOUS. The core git/gh publication behavior fits the skill’s stated purpose and most install paths are official, but the optional Graphite integration forwards auth to third-party CLI/service and raises trust and credential-handling risk. No confirmed malware, hidden execution, or clear exfiltration was found.