workplace-risk-scoring

SUSPICIOUS: the main analysis/reporting behavior matches the stated purpose, but the skill exceeds a clean single-purpose footprint by autonomously scanning the project, writing hidden telemetry under ~/.claude/projects, and recommending execution of additional skills. No direct credential harvesting, network exfiltration, or obviously malicious payloads are present, so this is not malware, but it carries moderate trust and transitive-execution risk.