tally

SUSPICIOUS: the skill's core behavior is coherent with its stated purpose, but that purpose is itself a third-party proxy for Tally. The main risk is data-flow integrity and credential mediation through ClawLink, not obvious malware or a deceptive installer. Supply-chain risk is moderate because the CLI comes from npm and appears same-brand, but routing account access and Tally operations through a hosted intermediary materially raises security risk.