agent-resource-allocator

SUSPICIOUS. The skill’s capabilities fit its stated resource-allocation purpose and there is no clear credential theft or exfiltration, but it depends on an unpinned external claude-flow CLI with ambiguous provenance across multiple repos/publishers. Main risk is supply-chain and operational impact, not confirmed malware.