tc-run

SUSPICIOUS. The skill’s core behavior matches its QA-testing purpose, but it relies on an unverifiable `orca/orca-graph` dependency, uses a live authenticated browser session, and sends test artifacts to an unclear MCP reporting service. This is not confirmed malware, but it carries high security risk due to supply-chain uncertainty and access to sensitive session data.