security-remediation

SUSPICIOUS. The skill’s capabilities mostly match its stated remediation purpose and it includes sensible secret-reading prohibitions, so it is not fundamentally malicious. Risk is driven by autonomous Bash-enabled code modification without a manual gate and by reliance on an externally referenced SDK / same-publisher GitHub install ecosystem with limited release-verification detail.