rightstack

SUSPICIOUS: the skill’s purpose and read-only behavior are mostly coherent, but it relies on an externally sourced RightStack package/service whose public provenance could not be verified from the provided evidence. No clear credential theft or malicious action appears, yet the unverifiable dependency and opaque network/data path make this a high supply-chain trust risk.