migration-verify

SUSPICIOUS. The core migration-review capability is legitimate and no external credential theft or remote installer is present, but the skill is over-autonomous for its purpose, encourages broad codebase execution/inspection, and writes telemetry outside the repository into an undocumented local Claude path. Risk is moderate rather than malicious because data stays local and there is no clear external exfiltration or supply-chain payload.