grasshopper-python-components

SUSPICIOUS: the skill’s purpose and local file-handling capabilities are coherent, and its data flows stay local with no credential collection or exfiltration. However, it depends on an unverifiable CLI (ghravioli) whose provenance and official distribution path are not established in the supplied evidence, creating a mandatory high supply-chain trust concern disproportionate to an otherwise benign documentation/build workflow.