yak-pilot

SUSPICIOUS. The skill's stated purpose matches orchestration, but its main risk is transitive trust and broad unattended execution: it loads multiple unspecified sub-skills and continues autonomously after limited approval. No direct malware, credential theft, or exfiltration is evident in the provided text, but the unverified dependency chain and high-autonomy behavior make the overall skill medium risk.