harvard-art-museum-etl-analytics

SUSPICIOUS. The skill’s capabilities and data flows fit its ETL/analytics purpose, and it uses the official Harvard API directly. The main concern is install trust: it tells the agent/user to clone and execute a personal GitHub repository that is not clearly affiliated with the stated publisher, raising supply-chain risk without clear evidence of malicious intent.