contract-test

SUSPICIOUS: the core contract-testing behavior is mostly coherent and uses mainstream package registries, but the skill is overly autonomous, performs broad repo/home-directory access, may publish data to arbitrary configured Pact Broker endpoints, and includes unrelated hidden telemetry persistence. Not confirmed malicious, but the footprint is broader than necessary for a focused testing skill.