jb-markit

SUSPICIOUS: the core document-to-markdown purpose is coherent, and the requested AI credentials are mostly proportionate, but the skill expands trust significantly through plugin installation from arbitrary npm/git/local sources and has some provenance ambiguity between the referenced repo and install package. The main concern is supply-chain and transitive code execution risk, not confirmed malicious behavior.