poteto-mode

SUSPICIOUS. The skill is mostly a benign agent-style and workflow guide with no meaningful supply-chain or exfiltration path, and the command-substitution findings are documentation artifacts. The main risk is autonomy scope: it encourages the agent to take external and workflow actions without pausing, which is broader than a pure writing-style skill and raises operational risk even without clear malicious intent.

No malware or covert data-theft behavior is present because the fragment is an explicit cleanup playbook rather than executable package code. It presents a significant operational data-loss risk through forceful worktree, simulator, runtime, application-state, and cache deletion. Execution should require independent path validation, explicit confirmation for every non-clean or uncertain item, and avoidance of `rm -rf` unless the exact surviving path is verified.