customize-yak

SUSPICIOUS. The skill's purpose and core file access are coherent, and it includes explicit approval gates before writes, so it is not malicious on its face. The main risk is transitive trust: it executes an unverified local Python script from another skill and writes persistent agent-instruction content that affects future sessions. With no network exfiltration or credential harvesting shown, this is better classified as medium-risk workflow/instruction-chain exposure rather than malware.