website-migration-audit

SUSPICIOUS. The skill's purpose is coherent, but it combines untrusted web-content ingestion with Bash/Write capabilities and routes optional analytics access through Cogny's managed MCP rather than direct Google/Microsoft APIs. No malicious payload or installer is present, yet the third-party token mediation and prompt-injection exposure make the overall risk medium.