clean-branches

The skill's footprint is coherent with its stated purpose: it identifies merged and stale branches, requires explicit user confirmation, and uses safe delete semantics. It minimizes data exposure and avoids autonomous real-world actions or credential usage. The only moderate concern is potential shell-injection risk if the user-supplied pattern isn't sanitized by the underlying script, but this appears to be an edge-case mitigated by internal script handling. Overall, the tool is benign and appropriately scoped for its purpose.