mr-obsidian

SUSPICIOUS: the core purpose is benign, but the skill’s footprint is not fully proportional. A note-structuring skill should not require a pre-run update script or encourage transitive skill installation from a personal repo. No explicit credential harvesting or exfiltration is shown, so this is better classified as suspicious/high-vulnerability than malicious.