agent-team

SUSPICIOUS. The skill’s core behavior mostly matches its purpose, but it combines broad repo ingestion, code/file modification, command execution, and autonomous multi-agent orchestration. The biggest concerns are the transitive trust chain (`npx skills add` from a personal GitHub repo) and the high prompt-injection surface from reading untrusted repo content while retaining write/exec capability. I see no clear credential theft or exfiltration, so this is not confirmed malware.