agency-reality-checker

SUSPICIOUS. The skill’s purpose and capabilities mostly align for local QA/integration review, and there is no clear credential theft or external exfiltration path. The main concern is execution trust: it mandates running an unverified local script (`./qa-playwright-capture.sh`) that is not an official Playwright command and whose behavior cannot be validated from the skill text alone. Overall this is a moderate security risk from opaque local code execution, not confirmed malware.