harvest

SUSPICIOUS: the skill's Harvest purpose is coherent, and the CLI appears to come from the same ClawLink publisher, so this is not overt malware. However, it routes all Harvest access through ClawLink as a third-party intermediary, stores a local ClawLink credential, and enables real account writes; this makes the data flow and permission model broader and riskier than a direct official Harvest integration.