dev

SUSPICIOUS: the skill's development-orchestration purpose largely matches its capabilities, but it concentrates trust in an external CLI that analyzes and edits the repo, can receive model credentials, and may route data to multiple providers. The main concern is not obvious malware but supply-chain and credential-forwarding risk, compounded by invocation of a separate third-party agent (`dev-plan-generator`).