nexus

SUSPICIOUS. The skill’s capabilities are largely aligned with its stated purpose as a meta-orchestrator, but its footprint is high-risk because it defaults to autonomous execution, uses bypassPermissions for spawned agents, and can recursively act on project/repo content. This looks more like a powerful automation/orchestration skill than malware, but it materially increases the chance of unsafe autonomous actions and prompt-injection-driven misuse.