launch-signals

SUSPICIOUS. The skill’s stated purpose and actual capabilities mostly align, and it appears focused on public-record intelligence gathering. The main risk is trust: it depends on a third-party remote MCP/bash service and instructs transitive plugin installation, with incomplete verifiability for the marketplace repo and no strong release-verification evidence. No clear credential theft, secret-file access, or malicious exfiltration is shown.