soia-dev-run-ops-inspection

SUSPICIOUS: the stated purpose is coherent and mostly read-only, but the installation footprint is broader than necessary because it uses transitive skill installation and requests wildcard agent permissions. No direct credential harvesting or malicious data routing is evident from the skill content itself, so this looks more like over-broad trust and permissioning than confirmed malware.