vibe-security-skill

SUSPICIOUS. The skill’s stated purpose and examples are coherent for a security-audit guide, and there is no evidence of credential theft, covert exfiltration, or malicious execution. The main concern is transitive trust: installation relies on a third-party `skills` CLI fetching a skill from a personal GitHub repo with branding/repo-owner mismatch, which is proportionally riskier than the skill’s benign instructional content.