government-compliance

SUSPICIOUS: the core compliance-review purpose broadly matches repository scanning, but the skill adds unnecessary autonomy, local telemetry writes outside the target project, and unresolved references to other slash commands/pipelines. No clear malware or external credential/data exfiltration is present, but the extra scope is not fully proportionate to a read-only review skill.