oneshot-workflow

SUSPICIOUS: The skill is broadly coherent for a workflow/VCS orchestration purpose, and it does not contain obvious credential theft, exfiltration endpoints, or download-execute installers. The main risks are autonomous repo write actions, opaque MCP-mediated VCS operations, and transitive trust in another skill; these make it medium risk rather than benign.