document-generation

Purpose and capabilities are well aligned: the skill writes documents, refuses fabrication, and does not request excess credentials or unrelated access. The main concern is install/execution trust: it requires an undisclosed local MCP executable referenced by $DOCUMENT_MCP_CMD, so the backing dependency cannot be independently verified from the skill text even though same-org NetClaw evidence suggests legitimacy. Overall this is suspicious from a supply-chain perspective, not malicious.