research-summarizer

SUSPICIOUS. The skill’s stated purpose is benign and its capabilities are proportionate, but the install/provenance story is inconsistent: author-aligned evidence points to one GitHub owner while the skill tells users to clone another, and one installer path appears undocumented. There is no sign of credential harvesting or malicious data flows in the skill content itself, so this looks more like supply-chain trust ambiguity than confirmed malware.