fabric

SUSPICIOUS. The skill’s capabilities mostly match its stated Fabric-helper purpose, and there is no clear credential harvesting, hidden exfiltration endpoint, or malicious pre-execution behavior. However, it normalizes runtime `git clone`/`git pull` from a mutable branch and immediate autonomous execution of an external CLI on remote content, which is more trust than necessary and leaves medium supply-chain risk.