audit-prototype

SUSPICIOUS: the skill’s stated auditing purpose broadly matches its file reads and report writes, and there is no direct credential harvesting or explicit exfiltration path. However, it relies on an unresolved external CLI (nvst) and additional skills, making the trust chain unverifiable and pushing risk high for a skill that can access substantial project data.