pm-need

SUSPICIOUS: the stated PM-orchestration purpose broadly matches the repo scanning and artifact generation behavior, but the skill is high-friction because it ingests arbitrary external content, scans broad local context, and in `--auto` mode chains multiple write-capable sub-skills without a pause. No strong evidence of malware or credential theft, but the prompt-injection and autonomous workflow risks are real.