forge-notifications

SUSPICIOUS: the stated purpose is plausible, but this file is only a loader that defers to unseen local playbooks and dynamically composed repo content. There is no direct exfiltration or credential harvesting in the visible text, but the transitive trust chain and unverified tooling provenance make the skill medium risk.