exist

SUSPICIOUS: the skill's stated purpose matches its capabilities, and the npm-based install path is not inherently malicious, but the integration is entirely mediated by ClawLink rather than Exist directly. That creates moderate supply-chain, credential-forwarding, and data-flow trust risk disproportionate to a direct first-party integration, though not enough here to call it malicious.