privacy-compliance

SUSPICIOUS. The visible skill content is mostly coherent, documentation-oriented, and proportionate to privacy-compliance tasks, with no clear credential harvesting or exfiltration. However, the actual executable Python scripts are missing from the scan, and external install evidence points to mutable third-party GitHub-based skill installation with inconsistent publisher identity, which raises supply-chain trust concerns.