check-vanta

SUSPICIOUS. The skill's purpose is coherent for security remediation, and most endpoints are official, but it grants an agent broad autonomous power: reading raw credential files, modifying many repos, pushing branches, and creating public/remote artifacts without user confirmation. This is high-risk autonomy rather than confirmed malware.