open-prose

SUSPICIOUS: mostly coherent with its orchestration purpose and no direct credential-exfiltration behavior, but it expands trust to arbitrary git-hosted dependencies and transitive contract execution. The autonomy-abuse finding appears overstated; the main risk is moderate supply-chain and transitive trust, not confirmed malware.