whitepaper

SUSPICIOUS. The core PDF-generation behavior and dependency choices align with the stated purpose, and there is no clear credential theft or exfiltration. However, the skill is disproportionately destructive: it mandates fully unattended execution and deletion of the original Markdown source after rendering, which does not belong in a normal whitepaper generator. Supply-chain risk is moderate rather than severe because installs are from official channels, but the unpinned GitHub binary download adds trust risk.