asta-documents

SUSPICIOUS. The skill’s core behavior largely matches its stated document-management purpose, and the primary installer appears same-org and version-pinned. However, repo inconsistency, remote index ingestion from arbitrary decoded URLs, optional cloud-credential use, and untrusted-content fetching with Bash/Read capabilities create meaningful medium risk beyond a simple local bookmark index.