game-recon

SUSPICIOUS. The skill’s purpose and file-reading behavior fit game modding recon, and the scanner’s command-injection alert is effectively a false positive. However, the skill materially relies on an external `um` executable delivered via plugin/session hook or local clone, and the provided evidence does not verify official provenance or release trust for that binary. That makes the skill’s execution trust disproportionally weak even though no credential theft or exfiltration is described.