fractal

SUSPICIOUS: the skill is internally consistent with Fractal's official purpose and uses a legitimate same-org CLI, so it does not look malicious or deceptive. However, it grants broad recursive autonomy to spawn and steer child agents that execute repository scripts and make persistent project changes, which is a meaningful operational risk even without obvious exfiltration or credential theft.