deep-research

SUSPICIOUS: the skill’s research/reporting purpose is mostly coherent, but its trust chain is weaker than ideal because it is installed from GitHub, can install additional upstream skills, and combines untrusted web ingestion with write/exec capabilities. No clear credential harvesting or overt exfiltration is present.