okf

SUSPICIOUS: The skill’s core file-oriented OKF guidance is broadly consistent with its stated purpose and shows no clear credential theft or exfiltration. However, trust is weakened by GitHub-based skill installation, unresolved provenance of the claimed Google upstream, unverified local installer script, and transitive skill-install patterns. Overall this is a medium-risk skill with supply-chain concerns rather than confirmed malware.