story

SUSPICIOUS: the visible skill is coherent for a software-delivery workflow and shows no direct malware, credential theft, or suspicious external install path, but it enables autonomous high-impact actions (commit/push/PR) and relies on unseen custom slash commands. Risk is driven more by autonomy and hidden downstream behavior than by this wrapper itself.