yolo-auto

SUSPICIOUS: the skill’s orchestration purpose is plausible, but the install path is the main problem. It relies on a non-verifiable personal GitHub skill repo and transitive skill installation, while advertising broad autonomous execution and a powerful tool bridge with limited detail. No confirmed credential theft or malware behavior is shown, but install trust and scope are disproportionate enough to classify as suspicious.