session-export-nocode

SUSPICIOUS. The stated purpose matches a session-export workflow, but the skill’s real footprint depends on transitive installation and execution of another skill from an unpinned personal GitHub repo. There is no clear remote credential exfiltration in this fragment, yet the combination of transitive trust, unattended export, and optional inclusion of credential-bearing sessions makes the overall skill medium-high risk.