alterlab-labarchive

SUSPICIOUS. The skill’s capabilities and official API data flows mostly match its stated LabArchives integration purpose, with no clear exfiltration or unrelated access. Risk comes from two issues: a third-party git-only wrapper with weaker provenance than an official registry/vendor package, and instructions that place an auth token on the command line. This looks more like a risky but purpose-aligned integration skill than malware.