orca-onboard

SUSPICIOUS. The core repo-analysis behavior fits the stated purpose, but the skill's footprint is broader than onboarding: it installs another skill, bootstraps harness code from GitHub/raw scripts, modifies user/global Claude setup, starts a local server, and even commits/pushes SKILL changes to a remote repository. These are disproportionate to codebase onboarding and create medium-high supply-chain and execution-trust risk, though there is no clear evidence of credential theft or deliberate exfiltration.