tailrocks-skill-create

SUSPICIOUS: The skill’s purpose and repository-writing behavior are broadly coherent, and there is no sign of credential theft or exfiltration. The main concern is install/execution trust: it depends on external CLIs and an unbundled scaffolder executable at `<installed-skill-path>` whose source and release provenance are not verifiable from the provided skill, which makes the mutation path a medium-high supply-chain risk.