code-forge

SUSPICIOUS: the skill's stated purpose and capabilities mostly align for code generation, and there is no direct credential theft or exfiltration behavior in the text. The main concern is transitive trust: it depends on multiple unspecified helper skills and command-like references without pinned publisher/version, so a resolver could pull different downstream instructions than the user expects. Overall this is a medium-risk orchestration skill rather than confirmed malware.