create-yaml-tests

SUSPICIOUS. The core testing purpose is coherent, and file access is proportionate for local test authoring, but the daily auto-update step introduces medium supply-chain and transitive-trust risk because it executes a mutable third-party skills CLI from npm that is not clearly Shiplight-owned. No strong evidence of credential harvesting, secret exfiltration, or malicious intent was found.