agent-import

SUSPICIOUS: the skill’s purpose broadly matches migration, but its real footprint is risky and only partially verifiable. The main concerns are the opaque download.py relay client, private relay provenance that cannot be confirmed end-to-end, workspace file import, and especially generating/executing task code from migrated content. This looks more like a high-risk migration utility than outright malware.