worktree-manager

SUSPICIOUS. The skill’s local Git/file/process capabilities mostly fit its stated worktree-management purpose, and there is no clear credential theft or malicious data exfiltration. The main concern is install trust: it asks users to install a third-party GitHub-hosted skill from a personal account, and the cited repo was not verifiable from the supplied evidence; the webhook examples also conflict with the claim of no network access.