heartbeat

SUSPICIOUS: the core behavior matches an infrastructure heartbeat skill, and no malicious installer or obvious credential theft is shown. Risk comes from autonomous recurring execution, external-content ingestion with command/file capabilities, and transitive reliance on other local scripts and skills.