agent-statsig

SUSPICIOUS. The skill’s stated purpose is coherent for Statsig administration, and its secret-handling guidance is better than official CLI docs. However, it requires an unresolved `agent-statsig` binary that does not match Statsig’s documented official CLI (`siggy`), and it forwards a highly privileged Console API key into that unverifiable executable. That provenance mismatch makes the skill high risk even without obvious exfiltration instructions.