upkeep-audit

SUSPICIOUS. The skill’s behavior mostly matches its purpose, but it relies on cloning and executing unpinned code from a personal GitHub repository, then running npm ci and shell scripts locally. The data flow to Claude reviewer subprocesses is plausible for an audit skill, but the install and execution trust model is high-risk enough to warrant caution.