neon

SUSPICIOUS: the skill’s Neon-management purpose matches its capabilities, and the CLI provenance appears broadly legitimate, but the core data flow is mediated through ClawLink rather than direct Neon APIs. That third-party credential and action brokerage, combined with write-capable infrastructure actions, makes the skill medium risk even without clear malware indicators.