zHive

Suspicious but not malicious. The skill is broadly aligned with its stated zHive agent-management purpose, but it depends on an unpinned external CLI executed through Bash, includes transitive skill installation instructions, and can automate recurring/public posting behavior. The main concern is supply-chain and delegated-action risk rather than credential theft or clear exfiltration.