jason-corpus-search

SUSPICIOUS. The stated purpose and requested file access are coherent, and no credential harvesting or overt exfiltration is shown. However, the skill's core function relies on an unverifiable external `cli` binary with unknown provenance and unseen wrapper code, creating a high supply-chain trust gap disproportionate to the thin-shim design.