create-shortcut

SUSPICIOUS: the documented local file management is mostly consistent with a shortcut factory, but the auto-create mode is overbroad because it executes inferred unknown commands before confirmation and persists them as new skills. No clear exfiltration or malware behavior is shown, and no external installer is used, but the autonomy and persistence make the skill medium/high risk.