community-sweep

The skill’s repository-maintenance capabilities broadly fit its stated purpose, and the scanner’s command-injection and concealment indicators are not substantiated by the instructions. However, it grants unusually broad autonomous authority over code merges, CI approvals, public communications, and releases; the transitive skills and unpinned installs add supply-chain uncertainty. Treat as high risk for autonomous actions, not confirmed malware.