healthcare-audit

SUSPICIOUS: the stated audit purpose is plausible, but the skill is over-scoped for a compliance review because it enforces autonomous execution, chains unverified sub-skills, includes a self-healing fix-validation loop that conflicts with its own 'do not modify code' rule, and silently writes telemetry to Claude memory. There is no confirmed malware or explicit external credential-exfiltration path in this skill alone, but the transitive trust and autonomous-action profile make it high-risk.