backlog-manager

SUSPICIOUS. The skill's purpose is legitimate and GitHub usage is coherent, but the Linear integration materially weakens trust by routing auth and task data through third-party `mcp-remote` rather than a clearly first-party local client. No confirmed malware or overt exfiltration is present, but install/data-flow trust is inconsistent across backends and should be treated as medium risk.