security-compliance-skills-suite-claude

SUSPICIOUS. The skill’s capabilities mostly fit its stated security/compliance purpose, but the installation trust is not coherent with the claimed publisher: users are told to load a skill from a different GitHub owner with no clear same-org relationship, pinning, or integrity checks. Credential and webhook requirements are plausible for IAM audit and incident-response workflows, and no covert exfiltration or pre-execution payloads are shown, so this is not confirmed malware; the main risk is transitive trust in an unverified third-party skill source with broad security-oriented capabilities.