autor3search-typescript

SUSPICIOUS. The skill’s purpose mostly matches its capabilities for benchmark-driven optimization, and it uses standard npm/npx tooling rather than covert installers. However, the install/run naming mismatch creates a meaningful provenance inconsistency, and the skill grants a third-party package execution over the user’s repository while following repository-local program.md instructions that may expand scope. This is not confirmed malware, but it has medium supply-chain and execution-trust risk.