product-manager

SUSPICIOUS: the stated purpose is broadly consistent with a PM reporting skill, but it is overpowered by scheduled autonomous execution, Slack notification, and trust in additional Zenflow actions not provided for review. No direct malware or credential-harvesting behavior is visible in the contract alone, yet the missing implementation details and transitive trust chain make this a medium-risk skill.