impact-org

SUSPICIOUS: the skill is not overtly malicious and shows no credential harvesting or external exfiltration, but its true behavior is delegated to multiple unspecified subskills, it pushes autonomous multi-step execution, and it writes telemetry to a home-directory Claude path. Risk is mainly transitive trust and scope expansion, not confirmed malware.