second-opinion

SUSPICIOUS: The skill’s purpose mostly matches its behavior, and the primary installs appear official, but the Gemini path materially increases risk by using --yolo and optional extensions that can act without confirmation. This is not confirmed malware, but it is a higher-risk automation pattern with external code/data exposure and delegated tool execution.