commandcode-delegate

SUSPICIOUS. The stated purpose matches the capability of delegating coding work to Command Code, and the CLI itself appears to be the official product from official docs/npm. However, this import is docs-only, relies on an absent external relay from a personal upstream repo, and normal operation intentionally uses unsandboxed `--yolo` execution that can read/write beyond the target tree and may forward repo content to a provider. No clear evidence of credential harvesting, stealth, or malicious exfiltration appears here, but the transitive trust and full-trust execution model make the skill medium/high risk.