harvard-artifacts-etl-streamlit

SUSPICIOUS: The skill’s purpose and capabilities are broadly coherent for a museum-data ETL/dashboard workflow, and data flows appear direct to official or user-owned endpoints. The main concern is install trust: the skill published by ara.so tells users to clone code from an unrelated personal GitHub repo with weak provenance, which raises medium supply-chain risk but is not enough to indicate confirmed malware.