autonomous-loops

SUSPICIOUS. The skill's capabilities mostly match its stated purpose as an autonomous-loop guide, but that purpose itself is high impact: it promotes unattended code execution, git/GitHub actions, and merge automation. The main concrete supply-chain concern is the raw GitHub pipe-to-shell installer for continuous-claude; provenance appears same-project, so this is install-hygiene risk rather than clear maliciousness. Overall risk is driven more by autonomous external actions and prompt-injection exposure than by confirmed malware behavior.