forge-security

SUSPICIOUS: the stated purpose is coherent for a security-audit skill, but the reviewed file is only a pointer and shifts trust to unseen local playbooks, runtime code, and update mechanisms. No explicit credential theft or malicious exfiltration is visible, yet the hidden runtime footprint is too large and insufficiently verifiable to treat as benign.