doc-tdd-autopilot

SUSPICIOUS. The skill’s capabilities mostly match its stated TDD-orchestration purpose, and there is no clear credential theft, exfiltration endpoint, or malicious pre-execution payload. However, it grants unattended write behavior and delegates core actions to local third-party framework code and transitive skills from a personal repo, which raises medium security risk despite otherwise coherent purpose and data flow.