harvard-artifacts-data-pipeline

SUSPICIOUS: the skill’s stated ETL/dashboard purpose is coherent, and its credential and network use are proportionate, but install trust is inconsistent because the skill claims ara.so authorship while directing users to clone and run code from an unrelated personal GitHub repository. No direct exfiltration or overtly malicious behavior is shown, but the provenance mismatch and third-party code execution make it medium risk.