Academic Figure Workflow Orchestrator

SUSPICIOUS. The workflow purpose is coherent, and the confirmation gates reduce abuse risk, but it conditionally executes an unverifiable local skill script outside an official package/release channel and relies on transitive trust in other skills/MCP tooling. Main risk is supply-chain and backend provenance, not confirmed malware.