shadow-testing

SUSPICIOUS: the core behavior is coherent with a shadow-testing skill and the publisher/source relationship appears legitimate, so this is not confirmed malware. However, the install instructions are inconsistent with the official repo, and the skill encourages broad API-key passthrough into containers that run arbitrary commands, creating a meaningful credential-exposure and execution risk.